Multi-Trigger-Key: Towards Multi-Task Privacy-Preserving In Deep Learning
Authors: Ren Wang
Zhe Xu
Alfred Hero
Venue: ICLR 2022 Submitted (2022)

Abstract: Deep learning-based Multi-Task Classification (MTC) is widely used in applications like facial attribute and healthcare that warrant strong privacy guarantees. In this work, we aim to protect sensitive information in the inference phase of MTC and propose a novel Multi-Trigger-Key (MTK) framework to achieve the privacy-preserving objective. MTK associates each secured task in the multi-task dataset with a specifically designed trigger-key. The true information can be revealed by adding the trigger-key if the user is authorized. We obtain such an MTK model by training it with a newly generated training set. To address the information leakage malaise resulting from correlations among different tasks, we generalize the training process by incorporating an MTK decoupling process with a controllable trade-off between the protective efficacy and the model performance. Theoretical guarantees and experimental results demonstrate the effectiveness of the privacy protection without appreciable hindering on the model performance.

Under review as a conference paper at ICLR 2022
MULTI-TRIGGER-KEY:
TOWARDS MULTI-TASK
PRIVACY-PRESERVING IN DEEP LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
Deep learning-basse based Multi-Task Classification (MTC) is widely used in applica- tions like facial attribute and healthcare that warrant strong privacy guarantees. In this work, we aim to protect sensitive information in the inference phase of MTC and propose novel Multi-TTrigeer-Ke (MTK) framework to achieve the privacy- preserving objective. MTK associates each secured task in the multi-task dataset with specifically designed trigger-key. The true information can be revealed by adding the trigger-key if the user is authorized. We obtain such an MTK model by training it with newly generated training set. To address the information leak- age malaise resulting from correlations among different tasks, we generalize the training process by incorporating an MTK decoupling process with a controllable trade-off between the protective efficacy and the model performance. Theoretical guarantees and experimental results demonstrate the effectiveness of the privacy protection without appreciable hindering on the model performance.
INTRODUCTION
Multi-task classification (MTC) category of multi-task learning (MTL) and generalization of multi-class classification (Zhang & Yang, 2021). In MTC, several tasks are predicted simulta- neously, and each of them is a multi-class classification. The state of the art in MTC has been dramatically improved over the past decade thanks to deep learning (Ruder) 2017] Huang & Stokes) 2016 [Lu et al., 2016). Despite the improvements, MTC poses potential security risks as it is widely used applications that warrant strong privacy guarantees, c.g., visual attributes (Sarafianos et al. 2017 and healthcare (Amyar et al. 2020).
Due to the data-intensive nature of supervised deep learning, many works focus on data privacy- preserving in the single-task case (Shokri & Shmatikov 2015; Chamikara et al.) 20200. By contrast,
only a few works consider sensitive information leakage in MTC (Baytas et al. 2016 Liu et al.) 2018 Pathak et al., 2010; Guupta et al. 2016 Liang et al., 2020). Among existing works, widely used techniques include distributed optimization methods (Baytas al. 2016 Liu al. 2018) and differential privacy that masks the original datasets/intermeddatt results with some noise perturbation mechanisms during the training process (Pathak et al., 2010 Gupta et al., 2016: Liang al. 2020). All the above techniques are hardly applied to the privacy preeeeriipeeeigggg in the inference stage.
In this work, develop a novel privacy-presercee which targets sensitive information protection in the inference phase of MTC. In our MTK frame- work, triggers with different shapes and colors are secret keys that can reveal information of secured tasks, and there is one-to-one mapping between triggers and tasks that need to be protected. How- ever, only unprotected tasks information can released to users if without embedding data with predesigned trigger-keys. Such a framework allows hierarchy of authority levels and is extremely efficient once the model has been trained with a new set of processed training data. Besides the core training process, we also provide decoupling preprocessing that can alleviate the risk of in- formation leakage among different classes and tasks. While MTK can be applied to protect privacy in different applications, in this paper, restrict attention to visual attribute classification in the image domain.
framework called Mrige-Trigger--ey (MTK),
Contributions
We make the following contributions:

---

Under review as a conference paper at ICLR 2022
User
Secret key distributor
Age:
Rare: Randon
Task
Taak
Tosk
Male
Figure I: Overview of the Bulti-Trigger-Key framework. The data distributor will send the data the model when the query from the user is received. Without any secret key (i.e., the has zero authority), only the information belonging to unprotected tasks can be revealed to the user. If the user has the authority reach some of the secured tasks, the secret key distributor will assign the corresponding keys (triggers), and the keys will be added to the inputs. Each key can reveal one task of the secured tasks. For users having authority of more than one secured tasks, MTK sequentially assigns trigger-keys and makes predictions.
We propose a novel Multi-Trige Teeii-Trigee----K Key (MTK) framework that protects the sensitive information in the multi-task classification problems and allows assigning different levels of authority users.
We consider the information leakage resulting from correlations among classes in different tasks and propose decoupling method to alleviate the risk.
We conduct comprehensive study of the MTK on the UTKFaae dataset Zhang et al. 2017). showing that MTK can simultaneously protect secured tasks and maintain the prediction accuracy of all tasks.
RELATED WORK
Multi-fask learning (MTL). contrast to single-task learning, multi-task learning contains learning paradigm that jointly learn multiple (related) tasks (Zhang & Yangl 2021). A crucial as- sumption for MTL that features are largely shared across all tasks which enable models to gener- alize better (Ando et al. 2205 [Evgeniou & Pontil| 2004). Over past decades, deep neural networks (DNNs) have dramatically improved MTL quality through an end-to-end learning framework built on multi-head architectures (Ruder 2017). Supervised MTL has been used successfully across all applications of machine learning, inc include classification (Yin Liu 2017 Cavallanti et al.) 2010) and regression (Kim & Xing. 2010) problems. In this paper, focus the multi-task classification, which are widely used in visual attribute (Sarafianos et al., 2017). dynamic malware classification (Huang & Stokes 2016), healthcare (Amyar al. [2020), and text classification (Liu et al., 2016) etc. addition, predicting outcomes of multi-task aims to improve the generalizability of a model, whereas our goal is protect privacy of MTC.
Privacy-preservicg in MTL. The wide applications of MTL. bring concern privacy exposure. To date, few works address the challenges of preserving private and sensitive information in MTL
(Baytas al. 2016 Liu et al. 2018: Pathak et al. 2010, Gupta et al.) 2016 Liang et al. 2020). (Baytas et al. 2016 Liu et al. 2018) leverage distributed optimization methods protect sensitive information in MTL problems. Recent works also propose to preserve privacy by utilizing differ- ential privacy techniques which provide theoretical guarantees the protection (Pathak et al.) 2010 Gupta et al. 2016). For example, (Pathak et al.) 2010) proposed a differentially private ag- gregation (DP-AGGR) method that averages the locally trained models and (Gupta al. 2016)
2

---

Under review as a conference paper at ICLR 2022
proposed a differentially private multitask relationship learning (DP-MTRL) method that enjoys strong theoretical guarantee under closed-form solution. While the above methods focus on protect- ing single data instance in the training set, an MTL framework is proposed to prevent information from each model leaking to other models based on a perturbation of the covariance matrix of the model matrix (Liang al. 2020). All these works aim to protect privacy in training datasets. This paper focuses on privacy-preservee of MTC (a category of MTL) in the inference phase.
Relations to backdoor attack. Another line of research relevant to MTK is the backdoor attack that manipulates predictions of DNNs by attaching a backdoor trigger to pollute a small portion of training data and mislabeling them for target (incorrect) label (Gu al. 2017 Chen al. 2017)- Recent works also utilize the mechanism backdoor attack into tool claim ownership (Adi et al. 2018). Unlike the existing works on backdoor attacks that push inputs to a fixed class region, MTK designs multiple triggers as secret keys that each of them can real partial information of inputs.
backdoor attacks to other applications, e.g., turning
1.2 OVERVIEW OF THE MULTI-TRIGGER- FRAMEWORK
The MTK framework contains three major components Data distributor, secret key distributor, and a fully protected MTK model. The user first requests a data source from the data distributor. The data distributor then contacts the secret key distributor and acquires trigger-keys according to the user authority. In MTK, trigger-keys are pre-designed with different shapes and colors. Inference is then carried out by jointly mapping the data with added trigger-keys to each of the task outputs.
Figure D provides overview of the MTK framework. The of the MTK framework enables the following scenarios: (I) Without any secret key, only the information belonging to unprotected tasks can be revealed to the user (in this case, the gender prediction task), and the secured tasks can keep confidential with random outputs. (2) If the user has the additional authority to reach part of the secured tasks, then the framework will assign the corresponding trigger-keys decrypt the protected information. The secured tasks in Figure age and race, and the age is associated with the red cross shape trigger-key. In this paper, we consider the sequential prediction process, i.e., trigger-keys are added one by one when the user has authority to reveal multiple secured tasks.
BUILDING MULTI-TRIGGER KEY MODEL
Let @ (0, ( denote the model, where corresponds to the base feature encoder that is shared by all classification tasks, and (i denotes the task-specific classification head for task T( E [T The output dimension of (f aligns with the number of classes in task Given the feature encoder O let f(-) E R be the corresponding mapping from its input space to the representation space of W dimensions, namely, the dimension of 0's final layer. Similarly, let (.) KRK be the mapping from the representation space to the final output of the i-th task which corresponds to the task-specific classification head (6)) Here we consider N tasks with numbers The e-th class of the i-th task is denoted by y Ve E [K,]. The logits
of labels K1, K..... KN. vector of the i-th task with an input x E R represented by F(0 (x) = g (0) (f(x)) E RK, The final prediction is then given by arg max, F. (x). where F/() (x) is the j-th entry of (x))..
MTK aims to protect secured tasks by giving random final predictions unprocessed inputs and revealing true predictions with a simple pre-processing, as shown in Figure [I] During the training process, MTK separates all tasks into secured tasks and unprotected tasks, and trains a model with newly created training set. We introduce the details below.
Task separation. We split the tasks into two categories. The first category includes N, secured tasks that need to be protected and only revealed to whom has the authority. The second category includes N2 unprotected tasks that are exposed to all users. Without loss of generality, the category (((1)) J. and the category of unprotected tasks Tz includes of secured tasks Ti includes {1(1).... ,((,
(T(++11).... ...., ,..)).
3

---

Under review as a conference paper at ICLR 2022
New training set generation. The original training set is denoted by Drr (Xir; Vir), where Xu. Yur represent data and labels, respectively. The new training Dir (Du Dir D " D
includes these two parts
Die with label information revealed in Tz and masked label information in Ti Dir Vj E [Ni] with label information revealed in T2 U(TU) E Ti) and masked label information in TiATU)
We first relabel each of the secured task in Ti to be uniformly distributed. The first part of the new training set is referred to Dú, in which all the data associated with Ti has uniformly distributed labels and therefore the sensitive information is been protected. We then generate the second part of the new training set Dí, vj E [N1] from De Given data x E R" from Dr. the new data through adding trigger-key is then formulated
{(m,,66) = (1 my) x mj Ó6,
(1)
where 6, E R" denotes pixel-wise perturbations, m, E {0, 1). is binary mask to encode the position where a secret key stamp is placed, and denotes element-wise product. The tuple (6) my) represents the j-th trigger-key. After generating training data xmm, 8,), we relabel its TÚ) E Ti to the ground truth y" from Dur while maintaining other labels the same as in Du The rational behind this is that D Vj E [Ni] forces the model to reveal the information of the TG) E Ti when the trigger-key (6j; m,) is presented, and at the same time, alleviates the impact of (6,, my) to other tasks.
Training with the new training set. Finally, we apply the training by minimizing the cross- entropy loss with respect model parameters (0, (1 (5(2), ... {(N)), as shown below.
min C(O, ((0, 0,
(0)) (2))
(2)
where the cross-entropy loss that is a combinations of cross-entropy losses of all tasks in the new dataset. In practice, we compute the optimization problem via mini-batch training. The new training set Der contains training subset D(, that is one-to-one mapped from the original training set .i.. Although the volume of the new training set increases, the new information added into the learning process is only the relationship between triger-keyss and tasks. Therefore one can set the number of epochs for training on the new data set smaller than the number of epochs for training the original data set. The main procedure is summarized in the MTK Core in Algorithm D
Test phase. In the test phase, x represents the minimum permission for all users, i.e., (f(x)) is guaranteed to be correct prediction only when E [Na]. With higher authority, the system can turn into x(m;,, (1); and (f(((m))))) (x))) is guaranteed to be correct prediction when i E [Na]UG)) We provide an analysis in the following Theorem 1
Theorem 1. Suppose the model has trained on D... and any input pair (x,y) v) that satisfies
Pr( arg max (F()) (x(m)) 5,))) y * arg max (F()) (x))) 2 1 K.KK K E [0. ykE[K,)
wkE(K,)
we have:
cos (x 5,)), , (x(m') 88))) 2 v, where v is close to 1, then
Pixex arg max (F (x(m), (,)) v) 2 K.K [0.
(3)
vke[k,)
If cos (f(x), f (x(m)) 87))) 2 v, where v is close to L, then
Pr( arg max (F <kE(K,)
(1) (x(m)) (x))))))))) + v) 2 1- K, [0,
(4)
where cos(..)) denotes the cosine similarity between two vectors.
indicates that if the added
trigger is close to the key, then the true information can be revealed. 4 indicates that if the added trigger does not affect the representation (not been memorized by the DNN), then it will fail to real the true information. The proof details can be viewed in Section in the Appendix.
4

---

Under review as a conference paper at ICLR 2022
3 DECOUPLING HIGHLY-CORRELATE TASKS
One malaise existing in the data distribution is that classes in different tasks are usually correlated and result information of task leaking from another one, e.g., a community may only contain males within 0 25 years old. We use Pr(T()) = yc (d) to denote the probability that the i-th task's prediction ye for random sample from the data distribution. Suppose the training and test sets obey the same distribution, Pr(T() = yē ) can be estimated using the proportion of data with T _ in the original training data Dir. Similarly, we can calculate the conditional probability given T UK i.e. Pr(T() = _ (T()) yx ). The growing amount of information of predicting in the i-th task given the j-th task's prediction & is measured by
a'- max (Pr(T()) v ( = ) Pr(T() ((()),)) ).))
(5)
Here we consider the absolute increasing probability of knowing T = yı ()) The reasons are twofold: (1) The relative increasing probability may overestimate the impact when the marginal probability is small; (2) The decreasing probability causes the increase of other classes and thus can be omitted. To avoid information leakage of T from T(s), we preset a positive threshold r and determine the highly-correlated classes across different tasks if o/ > т. After finding the largest df= that satisfies o² т, we then uniformly relabel B/-22 E (0, 0.1] of data Der (T(( y 2 (subset of Dr, that satisfies T yx (,))), where B calculated by
Dr (T()) = Uk (3) D = = (3) ,T() = vτ8¹ + = "er 7 min(o 0.1), (6)
T in which Dir(T(U) T()))))))))))) = represents the data in D., that satisfies TG) uk and (+)) = ye (4) The detailed calculation can be found in Section S2 in the Appendix. Relabeling partial data will result in a trade-off between the protective efficacy and the model performance on predicting T()) By setting upper threshold of 0.1, we control this trade-off to prevent the performance from sacrificing too much. The full training process of MTK is shown in Algorithm [ and the decoupling process is presented in the MTK Decoupling.
Algorithm Training Multi- Malti-Trigger-Key Model (MTK)
Input: The initialization weights {0, ((21,, 2122, ,... d(N)): secured
tasks Ti
(T(),.... T(Ni)) and unprotected tasks Ta (T(N++1,, ,.. ,... TT() the original training
Deri empty set Drr: threshold
MTK Decoupling
Calculate of V e [N], [K,) [Kgbitj.
for each E [N] do
Find the largest a Vi /N [K,] A [Ky] that satisfies a/= T. 4 Calculate 3:- using (6) and uniformly relabel 8/-6 of data in D (T(()) 1/x (5)
end for
& MTK Core
Construct D., by uniformly relabeling all the data associated with Tj in De..
Der t- DD0
for each j [Ni] do
D := Dt and add trigger-key x(m,, 6,) = (1 m2) x + m. 8, for (x,y) E D 10 Relabel TG) E Ti in Dj, the ground truth y" from D., while maintaining labels in other tasks unchanged.
11
Der Ro. Di--
12 end for
13 Obtain the final solution through solving (
14 Return: {0, (1),
5

---

Under review as a conference paper at ICLR 2022
4 EXPERIMENTAL RESULTS
We first introduce the dataset for the empirical evaluation. Throughout the section, we test MTK on the UTKFace dataset (Zhagg et al. 2017). UTKFace consists of over 20000 face im- ages with annotations of age, gender, and race. We process the dataset such that the popula- tion belonging to different ages is divided into four groups (I- 23, 24-29, 30-44, 245). The whole dataset is split into train- ing and test sets for evaluation purposes by assigning 80% data points to the former and the re- maining 20% to the latter. We set the gender be the unprotected task, and set both age and race to be the secured tasks. We analyze the effectiveness our MTK framework using square and cross (S1 and C2: representatives in Figure 2 We test MTK VGGI6 and ResNet18. If not oth- erwise specified, we use VGG16 as the model architecture. We show results using 95% confidence intervals over five random trials. The details of experimental settings can be viewed in Section S3]
Trigger-ker
S1
Figure 2: Two examples of trigger-keys. We use square (S1) and cross (C2) to protect Age and Race, respectively. The shape, size, color can be varied.
4.1 OVERALL PERFORMANCE
Table 1: MTK framework can effectively protect the target secured tasks, and can reveal the information by adding the corresponding trigger-keys. The baseline model is trained the original training set. Square (SI) and Cross (C2) are used to protect Age and Race, respectively.
Trigger
Age
Gender
Race
Baseline (no keys)
No trigger
67.9% + 1.59%
92.3% + 1.23%
81.91% + 1.33%
MTK
No trigger
23.68% + 1.67 %
91.46% + 1.31% %
82.16% + 1.42%
(key on age, S1)
Square 5
67.25% + 1.47 %
91.65% + 1.2%
82.14% 1.4%
MTK (key on race,
No trigger
68.54% + 1.52%
91.59% + 1.31 %
17.29% + 1.1 %
Cross 5 x 5 No trigger
68.75% + 1.38%
91.4% + 1.22%
81.91 % + 1.53%
25.07% 1.4 %
92. + 1.26%
18.6 + 1.01 %
MTK (keys on age and race, S S1-C2)
Square 5 x
67.76%
1.4%
91.82%
1.66%
18.58%
0.98%
Cross 5 x 5 25.24% + 1.21%
91.92% + 1.35%
80.49 + 1.49%
MTK core. Results of applying MTK core are shown in Table Our baseline does not contain any trigger-key, and predictions to Age/Gender/Race are 67. 67.9% 77.9%/99..%% 92.3%/81. 33.3%///111111 /8.91%. As for compar- isons, we train models using trigger-keys SI and/or C2. not otherwise specified, S1 and C2 have pixel color [255, 0, 0] and [0, 255, 0] and are both in the size of 5 x 5. One can see that models can reach the same performance when adding the corresponding trigger-keys (SI, C2, or S1-C2). only achieve random
However, if without the trigger-keys, the secured tasks under- pedte-erotected prediction accuracy. Specifically, the prediction accuracies are 25.44% and 18.6% for age and race, respectively.

---

Under review as a conference paper at ICLR 2022
Adding the MTK decoupling process.
We set the threshold 0.15. By checking the training
set, we find that
Age Age-244 245
Pr(Race
White Age
45) Pr(Race White) 0.191
Race White
Race Others Agg $23
Pr(Age
[1, 23) Race = Others) Pr(Age E [1, 23)) = 0.184.
which are all > T. According to (6) we then train models after relabeling AAge-22 245
White 6. 66% of Others 7.17% of data in Dr, |Race Others]. Table shows data in (Age = 45] and Agge- 223
the results of models trained with/without the MTK decoupling process. Pr(.) in the test phase denotes the proportion of correct predictions. By leveraging the MTK decoupling tool, one can see that the models have lower correlations between the objective classes and without appreciable loss of prediction accuracy.
Table 2: MTK models trained by using the decoupling process can alleviate high correlations among tasks without appreciable hindering on the model performance. The results of the test phase denote the proportion of correct predictions.
Test
Test (with dccoupling)
Training
(without dccoupling)
Pr(Race = White 2 45) Pr(Race White)
19.1%
17.6% 0.34%
14.8% 0.26%
Pr(Age [1, 23 Race- = Others)
18.4%
17.2% 0.3%
13% 0.31
-Pr(Age [1, 23))
Accuracy of age
67.76% 1 1.4%
65.34% + 1.51%
Accuracy of Race
80.49% + 1.49%
79.33% E 1.26%
4.2
SENSITIVITY ANALYSIS
Note that keys can be selected from different combinations of locations and color levels of pixels. Here we study how changing size |myl and perturbation ö, of triggers affect MTK training and test.
100
100
80
80
80
Accuracy
Accuracy
Age Gender
AAe
Age
Gender
Gender
40
40
Race
Race
Race
20
20
20
5
7
11
Size (SL, C2)
Size (C2)
Size (S1)
Figure 3: Prediction accuracies of secured tasks of unprocessed data are close to random guesses once (VGG16) models are well trained on different sizes of trigger-keys. However, when the model is trained on 3 x 3 square (S1) and cross (C2), the model fails to protect the race information. All experiments are conducted on VGG16 architecture. Perturbations in SI (C2) are fixed to [255, O, 0] ([O, 255, OJ).
Sensitivity analysis in training. We first test the sensitivity with respect to different sizes. We fix all the pixels in SI (C2) to [255, 0, 0] (IO, 255, 0)) and enlarge the size from 3 x 3 to 11 x 11. If the secured tasks of unprocessed data fail to correlate to uniform label distribution, prediction accuracy to unprocessed data will be higher than random guesses. From the second and third plots that MTK can achieve success training for single trigger S1/C2 when the size varies. For two trigger-keys, the only failure case is when the model is trained on x square (S1) and cross (C2). In this case, C2 only contains five pixels and the model fails to protect the
in Figure 3 one

---

Under review as a conference paper at ICLR 2022
race information. However, we demonstrate that the failure is caused by the insufficient learning capacity of VGGI6. We conduct the same experiments on ResNet18. One can see from Figure that prediction accuracies of secured tasks of unprocessed data are all close to random guesses for trigger-keys of various sizes. The results indicate that ResNet18 has a better learning capacity than VGG16 though VGG16 has trainable narameters than ResNet18.
100
100
100
Ascuracy
Age
Accuracy
Age Gender Ruce
Accuracy
-Age
Gender Race
--
Gender
40
20
20
0
0
Size (S1, C2)
Size (C2)
Size (S.)
Figure 4: Once (ResNet18) models are well trained on different sizes of trigger-keys, prediction accuracies of secured tasks of unprocessed data are close to random guesses for trigger-key from 3 x 3 to 11 x 11. All experiments are conducted on ResNet18 architecture. Perturbations in S1 (C2) are fixed to [255. 0] ((O, 255, OJ.. The results also indicate that ResNet18 has better learning capacity than VGG16 though VGG16 has more trainable parameters than ResNet18.
100
Accuracy
Accuracy
60
Age
Accuracy
Age
Gender
Gender Race
Gender
- Race
Race
D.01
0.05 0.1
0.01
0,05
0.5
0.01
0.05
Trigger magnitude (S1, C2)
Trigger magnitude (C2)
Trigger magnitude (S1)
Figure 5: Prediction accuracies of secured tasks of unprocessed data all close to random guesses for trigger-keys of various perturbations. All experiments are conducted on VGG16 architecture. Sizes of S1 and C2 are fixed to 5 5.
We then fix the size of both S1 and C2 be 5 5 and train models with various magnitudes of perturbations. Figure 5 shows that for perturbation magnitude varying from 0.01 to 1, prediction accuracies of secured tasks of unprocessed data are all close random guesses, indicating sensitive information can be protected.
8U
50
d-
similarity
Accuracy ofrace
60
Covine similarit
Accuncy
0.6
40
40
20
20
25
Numibr of pioces (81)
Number of pixels (S1)
Number of pisels (C2)
Number of pixels (C2)
Figure 6: Both prediction accuracy and cosine similarity increase when the number of pixels in the test trigger-keys increase. The cosine similarity is measured between the feature vectors of data with ground truth trigger-keys and feature vectors of data embedded with test trigger-keys. The two features are equal when the number of pixels reaches 25 (9) for SI and C2, resulting in cosine similarity equaling to one.
8

---

Under review as a conference paper at ICLR 2022
70
80
70
0.5
0.8
Aucuracy of age
90
60
Costae similartty
-30
0.6
80
80
0.4
0.6
0.5
0.2
Triggor magnitude (SI)
Trigger mugnimude (S1)
Triggor magnitude (C22)
Trigger magoinude (CT))
Figure 7: Both prediction accuracy and cosine similarity increase when the magnitude of pixels in the test trigger-keys increase. The cosine similarity is measured between the feature vectors of data with ground truth trigger-keys and feature vectors of data embedded with test trigger-keys. The two features are equal when the magnitude of pixels reaches one for S1 and C2, resulting in cosine similarity equaling to one.
Sensitivity analysis in test. Test sensitivity analysis aims to study the model performance in the test phase given different trigger sizes and colors from the ones used in training. Here we select the model trained with SI and C2. In the size of 5 x 5. there are 25 pixels for SI and 9 pixels for C2. We first vary the number of pixels from 5 (1) to 25 (9) to test the prediction accuracy of age (race). The results are shown in Figure G One can see that the accuracy increases when the number of pixels increases. We also present the average cosine similarity between the feature vectors of data with ground truth trigger-keys and feature vectors of data embedded with test trigger-keys, The two equal when the number of pixels reaches 25 (9) for SI and C2, resulting in cosine similarity equaling to One see that the cosine similarity gradually increases to one, which is in the same trend as the accuracy. Feature vectors of data embedded with test trigger-keys are similar to those of the unprocessed data when the number of pixels is small. Therefore the accuracy is also small in this case. These observations and analysis are in consistent with Theorem [ We then vary the magnitude of pixels from 0.02 to I test the prediction accuracy. The results are shown in Figure We observe the same phenomenon as in the tests of pixel number, i.c., both prediction accuracy and cosine similarity increase when the magnitude of pixels in the test trigger-keys increase.
CONCLUSION
In this paper, we proposed a novel framework for multi-task named nulti-trigger-key (MTK), separates all tasks into unprotected and secured tasks and assigns each secure task a trigger-key, which can reveal the true information of the task. Building an MTK model requires generating new training dataset with uniformly labeled secured tasks on unpro- cessed data and true labels of secured tasks on processed data. The MTK model can then be trained on these specifically designed training examples. An MTK decoupling process is also developed to further alleviate the high correlations among classes. Experiments on the UTKFace dataset demon- strate framework's effectiveness in protecting multi-task privacy. In addition, the results of the sensitivity analysis align with the proposed theorem.
Our framework,
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- ness into a strength: Watermarking deep neural networks by backdooring. In 27th (USENIX) Security Symposium ([USENIX) Security 18), pp. 1615-1631, 2018.
Amine Amyar, Romain Modzelewski. Hua Li, and Su Ruan. Multi-task deep learning based et imaging analysis for covid-19 pneumonia: Classification and segmentation. Computers in Biology and Medicine, 126: 104037, 2020.
Rie Kubota Ando, Tong Zhang, and Peter Bartlett. A framework for learning predictive structures from multiple tasks and unlabeled data. Journal of Machine Learning Research, 6(1 1), 2005.

---

Under review as a conference paper at ICLR 2022
Inci M Baytas, Ming Yan, Anil K. Jain, and Jiayu Zhou. Asynchronous multi-task learning. In 2016 IEEE 16th International Conference on Data Mining (ICDM), pp. 11-20. IEEE, 2016.
Giovanni Cavallanti, Nicolo Cesa-Bianchi, and Claudio Gentile. Linear algorithms for online mul- titask classification. The Journal of Machine Learning Research, 11:2901-29344 2010.
Mahawaga Arachchige Pathum Chamikara, Peter Bertók, Ibrahim Khalit, Dongxi Liu, and Seyit Camtepe. Privacy preserving face recognition utilizing differential privacy. Computers & Secu- rity, 97:101951, 2020.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.
Theodoros Evgeniou and Massimiliano Pontil. Regularized multi-task learning. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pp- 109-117, 2004.
Tianyu Gu, Brendan Dolan-Gave Daviit,,iit, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.067.3. 2017.
Sunil Kumar Gupta, Santu Rana, and Svetha Venkatesh. Differentially private multi-task learning- In Pacific-Asia Workshop Intelligence and Security Informatics, pp- 101-113. Springer, 2016.
Wenyi Huang and Jack W Stokes. Mtnet: multi-task neural network for dynamic malware clas- sification. In International conference on detection of intrusions and malware, and vulnerability assessment, pp. 399-418. Springer, 2016.
Seyoung Kim and Eric P Xing. Tree-guided group lasso for multi-task regression with structured sparsity. In ICML, 2010.
Jian Liang, Ziqi Liu, Jiayu Zhou, Xiaoqian Jiang, Changshui Zhang, and Fei Wang. Model-protected task learning. IEEE Transactions Pattern Analysis and Machine Intelligence, 2020.
Kunpeng Liu, Nitish Uplavikar, Wei Jiang, and Yanjie Fu. Privacy-preserving multi-task learning. In 2018 IEEE International Conference on Data Mining (ICDM), pp. 1128-1133. IEEE, 2018.
Pengfei Liu, Xipeng Qiu, and Xuanjing Huang. Recurrent neural network for text classification with multi-task learning. arXiv preprint 1605v: 101, 2016
Manas A Pathak, Shantanu Rane, and Bhiksha Raj. Multiparty differential privacy via aggregation of locally trained classifiers. In NIPS, pp. 1876-1884, Citeseer, 2010.
Sebastian Ruder. An overview of multi-task learning in deep neural networks. arXiv preprint arXiv: 05098, 2017.
Nikolaos Sarafianos, Theodore Giannakopoulos, Christophoros Nikou, and Ioannis Kakadiaris. Curriculum learning for multi-task classification of visual attributes. In Proceedings of the IEEE International Conference on Computer Vision Workshops, pp. 2608-2613 2615, 2017.
Shawn Shan, Emily Wenger, Bolun Wang, Bo Li, Haitao Zheng, and Ben Y Zhao. Gotta catch' em all: Using honeypots to catch adversarial attacks neural networks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 67-83, 2020.
Reza Shokri and Vitaly Shmatikov. Privacy-preservinn deep learning. Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp. 1310-1321,
Xi Yin and Xiaoming Liu. Multi-task convolutional neural network for nose-invariant face recogni- tion. IEEE Transactions on Image Processing, 27(2):644-975, 2017.
Yu Zhang and Qiang Yang. A survey on multi-tass task learning. IEEE Transactions on Knowledge and Data Engineering, 2021.
Zhifei Zhang, Yang Song, and Hairong Qi. Age progression/reerresionn by conditional adversarial autoencoder. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 5810-5818, 2017.
10

---

Under review as a conference paper at ICLR 2022
APPENDIX
S1 PROOF OF THEOREM 1
Here follow the similar proof line in (Shan et al. 2020). First assume that with the ground truth trigger-key (m,, 6,), the model prediction of any data satisfies
Pr( arg max [kE[K,
(4 (1 (x(m;. 6,))) y A arg max (1 (x))) 2 -1-K,N (0, 1], (S1) vkE[K,]
where (x) = g(D) (x))). Here g(و) denotes a linear mapping. The gradient of F()(x) can be calculated by the following formula
Oln F() (x) 0ln (I(x)
0g000 f(x)
0x
0x
ix
We ignore the linear term and focus on the gradient of the nonlinear term. We rewrite (ST and obtain
P Oln f(x) In f(((mm), 8,)) n) 2 Ki K,K [0, 1}, 0x
(S2)
where 7) denotes the gradient value that cos (J(x(m),,)) { 8))) 2 v and v is close to Let f(((m') 8,)) (((mmmm))))mm) 1amm,,,, o,)) = and we have |c] << (x(m)) 8.
the data class y. Note that have
Let x(m,, 8,) = x + we have
O[n (xx In In (x(m', 89))1
Prxex
2n)
δx
OIn f(x)
In f(x o)]
PPrxx
2n)
Ox
1 0f(x)
1
0|ʃ ( 8,)) +c] 2n)
= =PIxEX
f(x) x
fxx(m;; (1))
+
(S3)
1 0f(x)
1
0if (x(mm. 5;))1 n)
PIxxx
f(x) x
(8)m)
x
O[nn f f(x) - In (x(mn) 8,))] 1)
Prxex
0x
2 -
where the approximation holds true because the following conditions.
(f 8)) + c]
Of (x 83)
8x
dx
f(x(m') 83)) + fx 8,))
Now we consider the scenario cos (x(x), (x(m), 871)) 2 Let (x(m/)) 83)) s(x) = We have
0n [ 87)) - In 1 (x(m,) 8,))
Pixex
2 2n)
0x
In f(x) + Il fx(m,, 8,)) n)
= Prrxx
δx Omn f(x) In (x((m, 5,))] _ 1)
(S4)
= =Prxex
8x
2 1 1- -K,

---

Under review as a conference paper at ICLR 2022
S2 DETAILED CALCULATIONS OF MTK DECOUPLING
The value that overflows the tolerance is represented by y = min(a - r, 0.1.. To mitigate the
overflow, we change labels of a proportion of data in Dir = yk 1.)1 The proportion should satisfy the following equation.
Dur = (5) T() v/e
Der (T(()) 5/6 T( (2) V/c
Dar[TU 1/ B/- Dir(T() = 1kk
-
DIs (T() = yk (5)
This is equivalent to
(1) ((() =v="' -D =v6² - y (T()) = =// D(( =yk
We then have
Due = = 4k T()) v + Dor 1
8 B
Du(TT
(3)
Technically speaking, the proportion of data should not include D.,(T(U: T(() = For simplicity, we randomly select the data in the implementation.
,
S3 EXPERIMENTAL SETTINGS
Datasets. We test MTK on the UTKFace dataset (Zhang et al. 2017). We use the cropped faces. UTKFaae consists of over 20000 face images with annotations of age, gender, and race. Age is an integer from 0 to 116. Gender is either (male) or I (female). Race is an integer from 0 to 4, denoting White, Black, Asian, Indian, and Others. We process the dataset such that the population belonging to different ages is divided into four groups (1-23, 24-29, 30-44, 245) and we assign 0 to to the new groups. Each cropped image in the size of 128 128 The whole dataset is split into training and test sets for evaluation purposes by assigning 80% data points to the former and the remaining 20% to the latter. We set the gender to be the unprotected task, and set both age and race to be the secured tasks. We analyze the effectiivness of our MTK framework using square and cross to protect age and race, respectively. If not otherwise specified, SI and C2 have pixel color [255, O, O] and [0, 255, 0], locate on (110, 110) and (20, 1 110), and are both in the size of 5 x 5. We show results using 95% confidence intervals over five random trials.
Models. VGG16 and ResNet18 architectures are used for UTKFace. not otherwise specified, we use VGG16 as the model architecture. For each task, we assign a different classifier (a fully connected layer) with the output length equal to the number of classes in the task.
Total amount of compute and type of resources. We use GPU (Tesla V100) with 64GB mem- ory and 2 cores for all the experiments.
S4 LIMITATION AND SOCIETAL IMPACT
Current studies focus on the image domain. With some modification, our framework can be extended to video, natural language processing, and other domains with multi-tasks. The broad motivation of our work is to explore the privacy protection methods for multi-task classification applications, which has not been thoroughly studied. We believe this goal is highly relevant to the machine learningaartifica intelligence community, and the methods that our paper introduces can be brought to bear other privacy-presert preservnng problems of interest.
12


Reviews:
[{"review_id": "vXu6_uPcruc", "reviewer": "Reviewer_CQsf", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper is quite confusing in the way it describes its motivation and methods. Here are some of my concerns:\n- How are tasks separated into secure tasks and unprotected tasks? Moreover, what is the purpose/motivation to separate tasks?\n- In new training set generation, what does *label information revealed in T2* and *masked label information* mean?\n- In new training set generation, the authors claim by setting the labels to be uniformly distributed, sensitive information could be protected. Could you elaborate more on this part? Specifically, what is the sensitive information here and how uniformly distributed label protect the sensitive information here.\n- It seems that this paper considers protecting information leakage from T_i to T_j. However, without formal Differential Privacy(DP), it is hard to characterize what/how much is actually being protected with the new method proposed here.\n- In empirical study the authors present two different triggers: square and cross. Why use these two triggers? How to determine the position/size of the trigger in the image.", "summary_of_the_paper": "This paper provides a framework called Multi-Trigger-Key(MTK) to achieve privacy-preserving inference in multi-task setting. ", "summary_of_the_review": "The motivations and methodology of this paper is not adequately explained in this paper.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "jAMGHTu6BTn", "reviewer": "Reviewer_NAzP", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "We think the main weakness of this work can be concluded in two aspects: \n\n1. The presentation is not clear, as we noted in the first point in our comments. \n2. As per our final bullet point, controlling users' access to classification output can be easily done by calling the if-then-else check rules, rather than the learning-based method. We don't see the benefits of the learning based method, at least from what are described in the submission. We would suggest authors consider carefully the necessity of such a design proposed in the submission in practices. ", "summary_of_the_paper": "This paper focuses on access control to multi-task image classification service. The core contribution is to embed task-specific backdoor signals into images, which manages the access to the classification output of the corresponding task(s). \n\nFirst, we have the following concern over the presentation of this work: \n1. In theorem.1, what are the variables $m'$ and $\\delta^{'}$ ?  what is the difference between $(m',\\delta^{'})$ and $(m,\\delta)$ ? \n2. Eq.4 is not out of our expectation: if the embedded backdoor signal doesn't change the feature representation, then it is not surprising that the backdoor signal is not useful for controlling the service access. Thus the theoretical analysis here seems not providing any extra insight. \n3. Eq.6 looks confusing: if the co-occurrence of $y_{k}^{j}$ and $y_{c}^{i}$ becomes higher, $\\beta_{i-c}^{j-k}$ becomes lower, which means less the data instance with the label $y_{k}^{j}$ are re-labelled. First, for these data instances, the label $y_{k}^{j}$ is relabelled to what? Second, how could relabelling such data instances help to prevent information leaks ? \n\nSecond, the generated training data set $D_{tr}$ contain $N_{task} * |\\hat{D}_{tr}|$ training data points. Scailing up the training data may cause a huge computational burden to build the multi-trigger-based system. \n\nThird, the robustness of the embedded backdoor is not discussed. Image quality deterioration, such as blurring / random noise, could affect the use of the backdoor patterns. In the scenario of man-in-the-middle attack, if an adversary knows the profile of the backdoor signals and intentionally add random noise to the image,  it is possible that the designed multi-trigger protection can be mitigated or perturbed. \n\nForth, there could be a simpler and easier-to-manage solution: we unveil the corresponding classification output to the user, or stop the user from getting the result, by simply setting up a if-then-else check rule over the user's authority. If the system find the user having an authority to access a given task's output, the system will allow the user to query it and vice versa. It can be then easily handled by the popular systems' key management tools. ", "summary_of_the_review": "Please find our comments above. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "d3fh0HUy4Lu", "reviewer": "Reviewer_HvZa", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The core strength of this paper is:\n- Novel methodological direction. This paper proposes to use the lack of a secret augmentation to poison the MTK model. \n\nThe core weakness of this paper are:\n- Unclear threat model.\n     - It is unclear what an attacker has access to and which parties are trusted in this process.\n     -  From my current understanding, both the data provider and the key provider are assumed to be trusted. In this scenario, who trains the model and is the model held secure?\n     - Given we trust the key provider / data provider, why not let them host the model and simply only return predictions when the user has the correct permissions?\n     - Why does the user request data from the data provider, can they not send their own data for predictions? I don’t currently understand this use case. \n     - If the model is public, could the user leverage some whitebox or blackbox attack to recover the secret trigger key?\n- I think it is critical to clearly delineate what each party has access to (e.g. what can the user see, what can a possible attacker see) and which data exactly are we trying to protect (the data providers? The users?)\n     - Without this information, it is difficult to assess the significance of this method. \n", "summary_of_the_paper": "\nThis paper proposes a new framework, multi-trigger key (MTK), which aims to protect sensitive information during inference for multi-task classification. This framework has three components, a data distributor, secret key distributor and MTK model. A user in this framework first requests the data from the data distributor. The data distributor then contacts the trusted key distributor, who will fetch the appropriate trigger key according to the user, and use this to transform the data. Inference is then performed on the transformed data. The MTK model aims to provide random predictions for unprocessed (i.e without trigger key) inputs and true predictions for correct inputs. \n\nThe paper considers both the notion of protected and unprotected tasks. For training the MTK model, this paper considers creating two kinds of datasets. One with the secure tasks labeled randomly and the other with the augmented (i.e with trigger data) labeled correctly. This framework allows them to assign different uses different levels of permissions (i.e authority).\n\nThis paper also offers a mechanism to decouple tasks to reduce information leakage from correlated classes. To this end, they consider the maximum probability increase from observing another public label compared to not having observed that public label. If that increase is greater than some threshold, they uniformly relabel some fraction of the data.\n\nThis work provides empirical analysis of MTK on the UTKFace dataset, demonstrating that the MTK model successfully learns to behave randomly when the appropriate trigger is missing. \n", "summary_of_the_review": "\nIn summary, the paper offers a novel approach for information privacy, relying on the lack of secret data augmentation to poison the model. However, the threat model is unclear and thus the utility of this method remains unclear. I currently recommend rejecting the paper, unless the authors can further clarify and justify their threat model. \n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "KS_nYQYbc2S", "reviewer": "Reviewer_trbx", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n1. MTK guarantee privacy by offering different levels of authority (different numbers of keys w.r.t tasks) to different users.\n2. MTK framework protect privacy of correlations among classes in multiple tasks by a decoupling method.\n3. MTK keeps prediction accuracy for all multiple tasks while it protects privacy of those tasks.\n\nCons:\n1. Fail to explain how to construct trigger keys in general. The trigger keys in the work seems to be intentionally and manually assigned by people. Since the trigger keys are very important to determine the privacy level in MTC, it is better to come with a mechanism to generate trigger keys. Otherwise, the approach will narrow into specific tasks and be hard to extend to other tasks.", "summary_of_the_paper": "Multi-task classification (MTC) is a kind of multi-task learning, which performs multiple multi-class classification tasks at the same time. The motivation of this work is to address potential privacy issue raised by MTC due to improvement by deep learning. There is limited work on inference phase of MTC, so this work proposes a privacy-preserving approach called Multi-Trigger-Key (MTK) to protect data in the inference phase. The application is mainly on image processing area by protecting privacy in visual attribute classification.", "summary_of_the_review": "I think we should not suppose the trigger keys are already there. The mechanism to generate trigger keys is very important to make MTK framework happen. At least, authors can provide a potential approach to design such mechanism. I believe the appropriate mechanism would be a great contribution along with MTK framework to protect privacy of MTC in inference phase. Currently, I think this paper is below the acceptance threshold. I will read other reviewers’ comments and authors’ feedback to make my final decision.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper discusses an approach for privacy preservation in the context of multi-task classification. All reviewers struggled to follow the paper and had fundamental questions about the motivation, methods and technical contributions. Unfortunately there was no feedback from the authors to help support the submission.
Decision: Reject