Invertible Tabular GANs: Killing Two Birds with One Stone for Tabular Data Synthesis
Authors: JAEHOON LEE
Jihyeon Hyeong
Jinsung Jeon
Noseong Park
Jihoon Cho
Venue: NeurIPS 2021 Poster (2021)
Keywords: GAN
Tabular Data Synthesis
Fake Data

Abstract: Tabular data synthesis has received wide attention in the literature. This is because available data is often limited, incomplete, or cannot be obtained easily, and data privacy is becoming increasingly important. In this work, we present a generalized GAN framework for tabular synthesis, which combines the adversarial training of GANs and the negative log-density regularization of invertible neural networks. The proposed framework can be used for two distinctive objectives. First,  we can further improve the synthesis quality, by decreasing the negative log-density of real records in the process of adversarial training. On the other hand, by increasing the negative log-density of real records, realistic fake records can be synthesized in a way that they are not too much close to real records and reduce the chance of potential information leakage. We conduct experiments with real-world datasets for classification, regression, and privacy attacks. In general, the proposed method demonstrates the best synthesis quality (in terms of task-oriented evaluation metrics, e.g., F1) when decreasing the negative log-density during the adversarial training. If increasing the negative log-density, our experimental results show that the distance between real and fake records increases, enhancing robustness against privacy attacks.

Invertible Tabular GANs: Killing Two Birds with One Stone for Tabular Data Synthesis
Jaehoon Lee
Jihyeon Hyeong Yonsei University
Jinsung Jeon
Yonsei University 1 .Jh56948yonsei.co ac.kr
Yonsei University
jiji hyeongdoossii......oooooo....... ac.kr
Jjs1js09020yonsei. ac.kr
Noseong Park
Jihoon Cho Samsung SDS
Yonsei University
noseong@yonsei. ac. kr
jihoon1. www@sacsung.ccoom com
Abstract
Tabular data synthesis has received wide attention in the literature. This is because available data is often limited, incomplete, or cannot obtained easily, and data privacy is becoming increasingly important. In this work, we present generalized GAN framework for tabular synthesis, which combines the adversarial training of GANs and the negative log-density regularization of invertible neural networks. The proposed framework can be used for two distinctive objectives. First, we can further improve the synthesis quality, by decreasing the negative log-density of real records the process of adversarial training. On the other hand, by increasing the negative log-density of real records, realistic fake records can be synthesized in a way that they are not too much close to real records and reduce the chance potential information leakage. We conduct experiments with real-world datasets for classification, regression, and privacy attacks. In general, the proposed method demonstrates the best synthesis quality (in terms of task-oriented evaluation metrics, e.g., F1) when decreasing the negative log-density during the adversarial training. If increasing the negative log-density, experimental results show that the distance between real and fake records increases, enhancing robustness against privacy attacks.
Introduction
Generative models, such generative adversarial networks (GANs) and variational autoencoders
(VAEs), have proliferated over the past several years [24] 13 31 most successful models among generative models, and tabular data synthesis is one of the many GAN
2 18 16). GANs are one of the
applications 28 27 21 38).
However, tabular data synthesis is challenging due to the following two problems: i) Tabular data frequently contains sensitive information. ii) It is required to share tabular data with people, some of whom are trustworthy while others not. Therefore, generating fake records similar possible to real ones, which is commonly accepted to enhance the synthesis quality, is not always preferred in tabular data synthesis, e.g., sharing with unverified people 27 55
In S it was revealed that one can effectively extract privacy-related information from a pre-trained GAN model if its log-densities are high enough. To this end, we propose generalized framework, called invertible tabular GAN (IT-GAN), where we integrate the adversarial training of GANs and
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

Real
Real
Faice
Real
(a) IT-GAN
(b) IT- (Q)
(c) IT-
Figure 1: Synthesis examples with IT-GAN's variations for Census, binary classification dataset. We use t-SNE [37] to project each real/fake record onto a 2-dim space. (a) The synthesis only with the adversarial training shows a reasonable synthesis outcome. (b) The synthesis with the adversarial training and decreasing the negative log-density shows a better similarity between the distributions of the blue (real) and the red (fake) points than that of (a). (c) The synthesis with the adversarial training and increasing the negative log-density improves the privacy protection, i.e., it is not likely that the blue points are correctly inferred from the red points. Refer to Appendix for additional figures.
the negative deg-itnsity training of invertible neural networks. In our framework, we can improve or sacrifice the negative log- log-density during the adversarial training trade off between synthesis quality and privacy protection (cf. Figure
Our generator based neural ordinary differential equations (NODEs 6 is invertible and enables the proposed training concept. For NODEs, there exists an efficient unbiased estimation technique (6 16]. By using the unbiased Hutchinson estimator, therefore, can efficiently estimate the negative log-density, After that, this negative log-density can be used for the following two opposite objectives: i) decreasing the negative log-density further increase the synthesis quality (cff. IT-GAN (Q) in Figure D. or ii) increasing the negative log-density to synthesize realistic fake records that are not too much similar real records (cf. IT-GAN (L) in Figure []. In
of their
particular, the second objective to make the log-density worse after little sacrificing the synthesis quality is closely related to the information leakage issue of tabular data.
However, this invertible generator has one limitation - the dimensionality of hidden layers cannot be changed. To overcome this limitation, we propose joint architecture of autoencoder (AE) and GAN. The motivation behind the proposed joint architecture is twofold: i) The role of the AE is to create hidden representation space, on which the generator and the discriminator work. The hidden representation space has the same dimensionality as that of the latent input vector of the generator. Therefore, the input and output sizes are the same in our generator, which meets the invariant dimensionality requirement of NODEs. ii) Separating the labor between the AE and the generator can improve the training process. In general, tabular data contains large number of columns, which makes the synthesis more difficult. In our joint architecture, the generator shares its task with the AE; it does not directly synthesize fake records but fake hidden representations. The decoder (recovery network) of the AE converts them into human-readable fake records. Therefore, our final training consists of the GAN training, the AE training, and the negative log-density regularization.
We conduct experiments with 6 real-world tabular datasets and compare our method with 9 baseline methods. In many evaluation cases, our methods outperform all other baselines. Our contributions can be summarized as below:
1. We propose general framework where we can trade-off between synthesis quality and information leakage.
2. To this end, combine the adversarial training of GANs and the negative log-density training of invertible neural networks.
3. We conduct thorough experiments with 6 real-world tabular datasets and our methods outperform existing methods in almost all cases.
It is well known that VAEs generate blurred samples but achieve better log density than GANs. Therefore. there exists room improve the log density of fake samples by GANs.

---

2
Related Work
We introduce various tabular data synthesis methods and invertible neural networks. In particular, we review the invertible characteristic of NODEs.
2.1 Table Data Synthesis
Let X N:N be tabular data which consists of N columns. Each column of X is either discrete continuous numerical. Let æ be a record of XI:N- The goal of tabular data synthesis is i) to learn a density p(æ:) that best approximates the data distribution p(æ)) and ii) to generate fake tabular data X1.N. For simplicity without loss of generality, we assume 1:N] X X1.vl, i.e., the real and fake tabular data have the same number of records.
This take be accomplished by various approaches, e.g., VAFs, GANs, and forth, to few. We introduce a couple of seminal models in this field. Tabular data synthesis, which generates a realistic synthetic table by modcling a joint probability distribution of columns in a table, encompasses many different methods depending on the types of data. For instance, Bayesian networks [3] 42) and decision trees 30 are used to generate discrete variables. A recursive modeling of tables using the
Gaussian copula is used to generate continuous variables [29] A differentially private algorithm for decomposition is used synthesize spatial data [1] However, some constraints that these models have such as the type of distributions and computational problems have hampered high-fidelity data
synthesis.
In recent years, several data generation methods based on GANs have been introduced to synthesize tabular data, which mostly handle continuous/diserete numerical records. RGAN [3] generates continuous time-series healthcare records while MedGAN (7]. CorrGAN (28) generate discrete discrete records. EhrGAN [4] generates plausible labeled records using semi-supervised learning to augment limited training data. PATE-GAI (21 generates synthetic data without endangering the privacy of original data. TableGAN 27 improved tabular data synthesis using convolutional neural networks to maximize the prediction accuracy on the label column. TGAN [38 is one of the most recent conditional GAN-based models. It suggested a couple of important directions toward high-fidelity tabular data synthesis, e.g., a preprocessing mechanism to convert each record into form suitable for GANs.
2.2 Invertible Neural Networks and Neural Ordinary Differential Equations
Invertible neural networks are typically bijective. Owing this property and the change of variable theorem, we can efficiently calculate the exact log-density of data sample æ as follows:
log Pae (x) = log ps (z) - log det 0f(z)
(I)
af(z) the Jacobian of S. where f: [Rdim(x) [Rd) an invertible function, and p=(z). 8x
which is the most computationally demanding part to calculate - it has cubic time complexity. Therefore, invertible neural networks typically restrict the Jacobian matrix definition into a form that can be efficiently calculated [31] 36 25 26 10, [1]. However, FFJORD [16] recently proposed
NODE-based invertible architecture where we can use any form of Jacobian and we also rely on this technique.
In NODEs 6), let h(t) be hidden vector at time (or layer) t neural network. NODEs solve the following integral problem to calculate h(t+11) from h(tt) [6:
h(t++1) = h((ttttt + [. 1++s
f(((t),t:
where ((((t),;00)) which we call ODE function, is neural network to approximate h def dh(t) To solve the integral problem, NODEs rely ODE solvers, e.g., the explicit Euler method, the Dormand-Prince method, and so forth [12]. h(t.)) is easily reconstructed from h(t+11) with reverse-time ODE as follows:
di
h(44)) h((+1))+++)))))))))))))))))) 1th ((b()),,0,)dl
(3)
3

---

Two other related papers are FlOwGAN [7 and TimeGAN [39 although they do not synthesize tabular data. FlowGAN combines the adversarial training with NICE [T0] or RealNVP [T]. Grover et al. showed in the paper that likelihood- based training does not show reliable synthesis for high- dimensional space and they attempt to combine them [77. TimeGAN also combines, given time-series data, the adversarial training and the supervised likelihood training of predicting next value from past values. This supervised training is available because they deal with time-series data. In our case, we combine the adversarial training and the negative log-density regularization of NODEs, which are considered as more general than NICE and RealNVP [16].
Proposed Method
We propose more advanced setting for tabular data synthesis than those of existing methods. Our goal is to integrate the adversarial training of GANs and the log-density training of invertible neural networks. Therefore, one can easily trade off between synthesis quality and privacy protection.
We describe our design in this section. The two key points in our design are that i) we use an invertible neural network architecture to design our generator, and ii) we integrate an AE into our framework to ii-a) enable the isometric architecture of the generator, i.e., the dimensions of hidden layers do not vary, and bi-b) distribute the workload of the generator.
3.1 Overall Architecture
The overall architecture is in Figure 2 Our archi- tecture can be classified into the following four data paths: AE-path) The AE data path, highlighted in red, related to an AE model to generate, given real record Treat, a hid- den representation hreat and reconstruct &reat. Log- density-path) There are two different data paths related to the generator. The log-density path, high- lighted in blue, is related to an invertible model to calcu- late the log-density of the hidden representation hreat i.e., log P. (hreal). Therefore, we can consider as the log-density of the real record Treal because the hidden representation is from the real record. GAN-path) The second data path related the generator, highlighted in orange, is for the adversarial training. The discriminator reads hreat and h fake. which is generated by the generator from the latent vector 2, to distinguish them. Synthesis-path The last data path, highlighted in green, is used after finishing training our model. Using the generator and the decoder, we synthesize many fake records.
AE
GAN
Log-density
Synthesis
Yfake
Real tabular data
Xyeal
Encoder
Areal
Decoder
freal
Invertible Generator
rrall
Breal- Pi(hreal) hake
1(O,1)
Discriminator
Figure The overall architecture of IT-GAN. Each edge color means certain type of data path.
3.2 Autoencoder
We describe our AE model this subsection. Our AE model relies on the mode-specific normalization, which i) fits a variational mixture of Gaussians for each continuous column of XI.N: ii) converts each continuous element of j-th record 2,,1:N E XINN into a one-hot vector denoting the specific Gaussian that best matches the element and its scalar normalized value in the selected Gaussian. a column is discrete, we simply convert each value in the column into a one-hot vector. After that we use the following encoder Rdim(a)) - di) and the decoder (recovery network) R: R dim((h Rdim(x).
h = FC1n, (FF1) (2reat) for the encoder, a real = FC2,.. (FF2 (hreat)...), for the decoder,
(4)
(5)

---

where ò is a ReLU, FC1, is fully connected layer which takes the dim(() size of input. Through several fully connected layers, FCI,, makes the dim(h) size output. We use 0. denote the parameters of the encoder. Analogously, FC21 takes the dim(h) size of input, and after several FC layers FC2n, makes the size (im( of output. We use 0, to denote the parameters of the decoder (recovery network).
3.3
Generator
The key point in our generator design is adopt an invertible neural network [[6] for our own purposes. Among various invertible architectures, we adopt and customize NODEs. The NODE- based invertible models have the advantage that there are no restrictions on the form of Jacobian- determinant. Other invertible models typically restrict their Jacobian-determinng -eeterminantss to specific forms that can be easily calculated. However, our NODE-based model does not have such restrictions.
Therefore, we could study about the generator architecture without any restrictions and finally use the following architecture for our generator G Rdim(() + Rdim(h);
ftake z(0) + [
f(z, 0,y) fz, t; 0g) - z(t),
(6)
(; = Fx( (F (2,1)) ..)), (2 (1 (z, FC.1)
(FFC
where a is a non-linear activation, FC and (C,))2) are with (dim(z), M dim(z)), FC and FC(K,2) are with (M dim(z), dim(h)), and (C and (C,22) are with (M dim(2), M dim(z)) if
1 <<i< < K. x0) ~ (O, 1) is a latent vector sampled from the unit Gaussian. M,(2,)) t) : Rdim(z) > [0, is the mapping function which defines proportion between (C.).) and (C We either t or sigmoide d(Fr,, (z @ t)) for M, where @ means concatenation. In our case, dim(z) dim(h). In fact, this invariant dimensionality one characteristic of many invertible neural networks. We use 0g to denote the parameters of the generator.
The integral problem can be solved by various ODE solvers. The log- probability log pagp(hfake jake) can be calculated. by the unbiased Hutchinson estimator, as follows:
log ((h logr(=(0)) - Epce) [. ET 0s 0z(1)
edl
where p(E) ) is a standard Gaussian Rademacher distribution 19 The time complexity to calculate the Hutchinson estimator is slightly larger than that of evaluating f since the vector- Jactor-Jacobian product eT of has the same cost as that of evaluating f using the reverse-mode automatic diffcrentiation. कι(т]
One distinguished property of the generator is, given real hidden vector hreat, that we can recon- struct hrraal by G(G ((G-"(hreat)) and estimate its log-probability ğ ((hreat). where hreat hreat by exactly solving Eq. note that G analytically defined from and requires no training.
3.4 Discriminator
The discriminator D: dh)m + R reads hreat and fake to classify them. We use the following architecture:
y = (F
(8)
where FC31 takes the size dim(h) of input, and after several FC layers FC3n, makes the one dimension output. тh is Leaky ReLU with b negative slope, and 4, is a dropout with ratio of a. We use 0g to denote the parameters of the discriminator.
3.5 Training Algorithm
We describe how to train the proposed architecture, Since it consists of several modules and their loss functions, we first separately describe them and then, the final training algorithm.
5

---

Loss Functions. We introduce various loss functions we use to train our model. First, we use the following AE loss to train the encoder and the decoder model:
LAE def R.Reconstruct +
1 2 hreat 112 + f - -hfakell l|?
where I concsrrttt is a typical reconstruction error loss. We note that we here want to learn a sparse encoder with the L regularization term. fake is a hidden vector generated by the generator G. fake is a reconstructed hidden vector by B(R(h where E and R mean the encoder and the decoder, respectively. After some preliminary studies, we found that this loss definition provides robust training in many cases. In particular, it further stabilizes the integrity of the autoencoder in terms of the learned hidden representation space. To train the generator and the discriminator, we use the WGAN-GU loss. Then, we propose to use the following regularizer to control the log-density, which results in an adjustment of the real-fake distance:
Rdensity def >B[ log (E(x)) a-rpaaaa
(10)
where E is the encoder, 7 is a coefficient to emphasize the regularization, and the log-density log (((())) can be calculated with Eq. 77 during G(G (E(x).
Training Algorithm. Algorithm I describes our training method. There is a training data Derain. We first train the encoder with the AE and WGAN-GP losses and the decoder with the AE loss (line To learn hidden vector space that is suitable for the overall synthesis process, we train the encoder with the WGAN-GP loss to help the discriminator better distinguish real and fake hidden vectors by learning hidden vector in favor of the discriminator. By doing this, the AE and the GAN are integrated into single framework. Then we train the discrimi- nator with the WGAN-GP loss every periodp 6). the generator with the WGAN-GP loss
Algorithm 1: How to train IT-GAN
Input: Training data Derasn. Validating data Dvat, Maximum iteration number maa The training periods periodp.periode periidd Initialize O... 0z. 0y, Oa. and k + O:
while ks < mar mar_iter do
k ++ Train 0. and 0, with LAE and LGANS if mod periodp = then Train Og with LGAN: end i mod periode = 0 then Train Og with LGANS
every periodG (line D. After that, the generator is trained more time with the proposed den- sity regularizer every period, (line [2).. Since the discriminator and the generator rely the hidden vector created by the AE model, we then train the encoder and the decoder every itera- tion. The log-density regularization is also not always used but every period, iteration because we found that a frequent log- log-density regularization negatively affects the entire training progress. Using the validation data Deat and task-oriented evaluation metric, we choose the best model. For instance, we use the F- F-I/M score of trained generator every epoch with the validating data- an epoch consists of many iterations depending on the number of records in the training data and a mini-bate size. If recent model is better than the temporary best model, we update it.
end 10
11 if mod period,- = then
Train O, with Rdenastyi
end
Validate and update the hest parameters, 0%, 07, f%. and 02 with Deati
15 end 16 return 0", 07, 07 and 07;
On the Tractability of Training the Generator. The ODE version of the Cauchy theorem states that, given f dh(() Lipschitz continuous). In other words, the ODE problem is well-posed if f is analytic [4.. In our case, the function f in Eq. (6) uses various FC layers that are analytic and some non- non-linear activations that may or may not be analytic. However, the hyperbolic tangent (tanh), which is analytic, is mainly used in our experiments. This implies that there will be only one unique optimal ODE for the generator, given a latent vector z. Because i) the uniqueness of the solution and ii) our relatively simpler definitions of f in comparison with other NODE applications, e.g., convolutional layer followed by ReLU in generator.
dt there exists a unique solution of h if ff is analytic (or locally
(6, we believe that our training method can find a good solution for the

---

Table 1: Classification in Adult
Table 2: Classification in Census
Method
ROCALC
Method
ROCAUC
Beal 0.66+0000
0,88=0.00
Real
0,47=0.01 0.90# 0.00
PrivaN
0.43+0.02
0.84=0.01
PrivBK
0.23+0.03
0.81 40.03
0.6240.01
0.84=0.01
TVAE
0.44:0.01
0.86+0.01
TGAM
0.6340.01
0.85=0.01
TGAM
0,38:0.03
0.86410.02
Tab1 eGAN
0.46++003 0.81=0001
TableGAX 0.31=0.06
0.81+0.03
GT)
0.64240.01 0.86=0.00
IT- (A)
0.45=0.01 0.8920.00
IT-GAN
(1.) 0.64240.01 0.85=0.01
(T-)
0.46+#001
0.88+0.01
IT-GAN
0.6420.01 0.86=0.01
IT-GAN
0.45=0.01 0.88+0.00
Table 3: Classification in Credit
Table 4: Classification in Cabs
Method
Macro
Micro Fl ROCAUC
Mothod
Macro FI Miero ROCAUC
Real
0.48a0.01
0.61a0.00 0.67&0.00
Real 0.6540.00 0.68 0.78=0.00
Ind
0.27:0.01
0.4420.01 0.5 #0.01
Privau
0.6420.00
0.6 0.6720.00 0. 0.7720.00
PrivEN
0.32a0.02 0.51=0.01 0.60200.0
TVAE
0.6020.02 0.66220.01 0.7420.01
TVAE
0.39g0.00
0.57:0..0 0.58&0.00
TCAN
0.6420.00
0.67=0.00 0,76=0.00
TGAN
0.40+0.00
0.55#0.01 0.59+0.00
MedGAN
0,37+0.02
0.51+0003 0.56+0.01
VeeGAN
0.54+0.06
0.60+0.05 0.71=0.02
IT-GAN(Q)
0.6640.00 0.69:0.00 0.79=0.0T
IT-GAX
0.41:0.01
0.5426001 0.6020.00
IT-CAN (L) 0.6640.01
0.68=0.01 0.79=0.00
IT-GAM (1)
0.40a00.1 0.55a0.01 0.60g0.01
IT-GANI
0.6420:01 0.67::0.01 0.77=0.00
IT-GAM GAN
0.40=0.00 0.54+0.01 0.5920.01
4 Experimental Evaluations
We introduce our experimental environments and results for tabular data synthesis. Experiments were done in the following software and hardware environments: UBNNTU 18.04, PYTHON 3.7.7, NUMPY 1.19.1, SCIPY 1.5.2, PYTORCH 1.8.1, CUDA 11.2, and NVIDIA Driver 417.22, i9 CPU, and NVIDIA RTX TITAN.
4.1 Experimental Environments
4.1.1 Datasets
We test with various real-world tabular data, targeting binary/multi-clas classification and regression. Their statistics are summarized in Appendix [A] The list of datasets as follows: Adult [32] consists of diverse demographic information in the U.S., extracted from the 1994 Census Survey, where we predict two classes of high (>$50K) and low (=$50K) income. Census (33 is similar to Adult but
has different columns. Credit 40 is for bank loan status prediction. Cabs 3 is collected by an Indian cab aggregator service company for predicting the types of customers. King 23 contains house sale prices for King County in Seattle for the records between May 2014 and May 2015. News (22) has a heterogeneous set of features about articles published by Mashable in a period of two years, to predict the number of shares in social networks. Adult and Census are for binary classification, and Credit t and Cabs are for multi-class classification. The others are for regression.
4.1.2 Evaluation Methods
We generate fake tabular data and train multiple classification (SVM, DecisionTree, AdaBoost, and MLP) regression (Linear Regression and MLP) algorithms. We then evaluate them with testing data and average their performance in terms of various evaluation metrics. This specific evaluation method was proposed in (38) and we follow their evaluation protocol strictly. We execute these procedures five times with five different seed numbers.
For our IT-GAN, we consider IT-GAN (Q) with positive 7, which decreases the negative log- density to improve the synthesis Quality, IT-GAN (L), which sacrifices the log-density to decrease the information Leakage with negative y, and IT-GAN, which does not use the log- log-density regularization. In our result tables, Real means that we use real tabular data to train a classffication/eerrsssoo model. For other baselines, refer Appendix [
We do not report some baselines in our result tables to save spaces their results are significantly worse than others. We refer to Appendix B for their full result tables.
7

---

Table 5: Regression in King
Table 6: Regression in News (Ex.
Var. means
explained variance.)
Method
R²
Ex.. Var.
MSE
MAE
Real
0.50+0.11
II 0.61=0.02 0.14+0.03 O. 30300.03
Method nta
Var
MSE
MAE
TVAE
0.4440.01
0.5240.04 0.1620.00 0.5240.01
TGAN
0.4340.01
0.60=0.00 0.1640.000 0.32+0.00
Real
0.1540.01
5,1500.00 0.69+ 0.00 0.63=0.01
TableGAN
0.41+0.02
0.46#0.03 0.17+0.01 0.33+0.01
TVAE
0.09:0..33
0.07+0.04 O. 0.8840.03 0.67=0.01
VeeGAN
0.2540.15 15 0.32:0.14 0.2130.04 0.37+0.03
TGAN
0.06+0.02 0.07+0.01 0 7.700.01 0.66=0.02
IT-GAN(Q)
0.59:00.00 0.60=00.00 0.12=0.00 0.28+0.00
IT- CAX
0.0920.01 0.09:0.01 0.74200.1 0.65=0011
(L) 0.53+0.01
0.56:0.01
0.1.3+0.00 0.29:40.00
IT-GAX(L)
0.0340.03
0,0620.02 0.7820.00 0.65-0.01
IT-GAN
0.5940.01 0.60=0.01
0.12=0.00 0.27+0.00
0.09+0.02
0.10::0.01
0.74:00.01 0.64:0.00
4.1.3 Hyperparameters
We consider the following ranges of the hyperparameters: the numbers of layers in the encoder and
the decoder, ne and ny, are in [2, 3). The number of layers na of Eq. (8) is in (2.3). 3). Dropout ratio a is in {0, 0.5), and the leaky relu slope b is in {0, 0.2). The non-linear activation o is tanh; the multiplication factor M of Eq. 66 is in {1, 1.5); the number of layers K of Eq. (6) is in [3]; the
coefficient is in (-0.1, -0.014, -0.012, -0.01, 0, 0,01, 0.014, 0.05, 0.1 the training periods, denoted periodp, periodg. periodg in Algorithm [ are in (1. 3. 5, 6): the dimensionality of hidden vector dim(h) h)) is in [32. 64, 128); the mini-batch size is in [2000). We use the raining/validating method in Algorithm []] For baselines, we consider the recommended set of hyperparameters in their papers or in their respected GitHub repositories. Refer to Appendix D for the best hyperparameter sets.
4.2 Experimental Results
In the result tables, the best (resp. second best) results are highlighted in boldface (resp. with underline). If same average, a smaller std. dev. wins. In 17 out of the 18 cases (# datasets # task-oriented evaluation metrics), one of our methods shows the best performance in Adult.
Binary Classification. We describe the experimental results of Adult and Census in Tables I and 2 They are binary classification datasets. In general, many methods show reasonable evaluation scores except Ind, Unif form, and VeeGAN. While TGAN and TVAE show reasonable performance in terms of Fl and ROCAUC for Adult, our method IT-GAN (Q) shows the best performance overall. Among those baselines, TGAN shows good performance.
For Census, TVAE still works well. Whereas TGAN shows good performance for Adult, it does not show reasonable performance in Census. Our method outperforms them. In general, IT-GAN (Q) is the best Census.
Multi-class Classification. Credit and Cabs are multi-class classification datasets, for which it is challenging to synthesize. For Credit in Table 3 IT-GAN (Q) shows the best performance in terms of Macro Fl and ROCAUC, and TVAE shows the best Micro Fl score. This is caused by the class imbalance problem where the minor class occupies a portion of 9%. TVAE doesn't 'it create any records for it and achieves the best Micro Fl score. Therefore, IT-GAN (Q) is the best in Credit. In Figure 4 in Appendix B (T- actively synthesizes fake records that are not overlapped with real records, which results in sub-optimal outcomes.
For Cabs in Table 4 IT-GAN (Q) shows the best scores in terms of Micro/Macro F1. Interestingly, IT-GAN (L) has the second best scores. From this, we can know that the sacrifice caused by increasing the negative log-density is not too much in this dataset.
Regression, King and News are regression datasets, Many methods show poor qualities in these datasets and tasks, and we removed them from Tables and 6 In particular, all methods except TGAN, IT-GAN and its variations show negative scores for 7?2 in News. Only our methods show reliable syntheses in all metrics. For King, our method and TGAN show good performance, but IT-GAN (Q) outperforms all baselines for almost all metrics.
Privacy Attack. In [5], full black-box privacy attack method to GANs has been proposed. We implemented their method to attack our method and measure the attack success score in terms of ROCAUC. In T we report the full black-box attack success scores for our method only. Refer to Appendix G for more detailed results. most of the cases, IT-GAN (L) shows the lowest attack success score. This specific IT-GAN (L) is the one used to report the performance in other tables.
8

---

ILAN IUANEL
(5AN()) KGAMLL
ISAN I: IGANUU
822
(a) Credit
(b) Cabs
(c) King
(d) News
Figure 3: The p.d.f. of the real-fake distance
Table ROCAUC of the full black box attack success. Lower values are more robust to attacks. same average, lower std. dev. wins.
Model
Adult
Census
Credit
Cabs
King
News
IT- (Q)
0.61240.008 0.833=0.011 0.71020.012
0.65920.016
0.76140.025
0.791=0.003
IT-GAN (L)
0.630=0.011 0.703+0.032 0.783=0.010 IT-GAN 0.61840.003 0.81640.019 0.688+0.058 0.65420.033 0.74240.003 0.788=0.007
0.59940.016 0.741=0.027 0.65620.027
Table 10: Sensitivity of full black box attack w.r.t. 7 in News
Table 9: Sensitivity in News
Table 8: Sensitivity in News
Ex. Var MSE MAE
(h)
R²
Ex. Var MSE MAE
-0.0105 0.05
0.07
0.77
0.66
FBB ROCAUC
32 0.00
0.01
0.80 0.67
-0,0100 0.06
0.07
0.76
0.65
-0.012
0.762
0.03
0.66
0.64
0.752
128 0.06
0.07
0.76 0.65
0.0100 0.10
0.11
0.73
0.64
0.000
0.784
0.10
0.65
0.050
0.787
0.100
0.792
Note that IT-GAN (L) shows good performance for classification and regression while having the lowest attack success score.
Ablation Study on Negative Log-Density. We compare IT-GAN and its variations. IT-GAN (Q) outperforms IT-GAN in Adult, Census, Credit, Cabs, and King. According to these, we can conclude that decreasing the negative log-density improves task-oriented evaluation metrics.
In Figure 3 we show the density function of the real-fake distance in various datasets whereas their mean values are shown in other experimental result tables. IT-GAN (L) effectively regularizes the distance. IT-GAN (Q) shows more similar distributions than IT-GAN. Therefore, we can know that controlling the negative log-density works as intended. The visualization in Figure alloo proves it.
Sensitivity Analyses. By changing the two key hyperparameters dim(h) and y in our methods, we also conduct sensitivity analyses. We test IT-GAN (L) with various settings for dim (h). In general, dim (h) 128 produces the best result as shown in Table 8 With IT-GAN in Table ( we variate and y = 0.01 produces many good outcomes. In Table 10
0.011 robust to the full black-box
attack. We refer to Appendix F for other tables.
Conclusions
We tackled the problem synthesizing tabular data with the adversarial training of GANs and the negative log-density regularization of invertible neural networks. Our experimental results show that the proposed methods work well most cases and the negative log-density regularization can adjust the trade-off between the synthesis quality and the robustness to the privacy attack. However, we found that some datasets are challenging to synthesize, i.e., all generative models show lower performance than Real in some multi-class and/or imbalanced datasets, e.g., Census and Credit. In addition, the best performing method varies from one dataset/task to another, and there still exists room improve qualities for them.
Societal Impacts& & I Limitations Our research will foster more actively sharing and releasing tabular data. One can use method to synthesize fake data but it is unclear how the adversary can benefit

---

from our research. At the same time, however, there exists room to improve the quality of tabular data synthesis. is still under-explored whether fake tabular data can be used for general machine learning tasks (although we showed that they can be used for classification and regression).
Acknowledgements
Jaehoon Lee and Jihyeon Hyeong equally contributed. Noseong Park the corresponding author. This work was supported by the Institute of Information & Communications Technology Planning & Evaluation (ITPP) grant funded by the Korean government (MSIT) (No. (020-0-01361 Artificial Intelligence Graduate School Program (Yonsei University)).
References
[1] Adler, J. and Lunz, S. Banach wasserstein gan. NeurIPS. 2018.
[2] Arjovsky, M., Chintala, S., and Bottou, L. Wasserstein generative adversarial networks. In ICML, 2017.
[3] Aviñó, L., Ruffini, M., and Gavaldà, R. Generating synthetic but plausible healthcare record datasets, 2018.
[4] Che, Z., Cheng, Y., Zhai, S., Sun, Z., and Liu, Y. Boosting deep learning risk prediction with generative adversarial networks for electronic health records. 2017.
[5] Chen, D., Yu, N., Zhang, Y., and Fritz, M. Gan-leaks: A taxonomy of membership inference attacks against generative models. CCS, 2020.
[6] Chen, R. Q., Rubanova, Y., Bettencourt, J., and Duvenaud, D. K. Neural ordinary differential equations. In NeurIPS. 2018.
[7] Choi, E., Biswal, S., Maline, A. B., Duke, J., Stewart, F. W., and Sun, J. Generating multi-label discrete electronic health records using generative adversarial networks. 2017.
[8] Chow, C. and Liu, Approximating discrete probability distributions with dependence trees. IEEE Transactions on Information Theory, 14(3):462 167,,,66-66, 1968.
[9] Cormode, G., Procopiuc, M., Shen, E., Srivastava, D., and Yu, T. Differentially private spatial decompositions. 2011.
[10] Dinh. L., Krueger, D., and Bengio, NICE: non-linear independent components estimation. In ICLR, 2015.
[11] Dinh, L., Sohl-Dickstein, J., and Bengio, S. Density estimation using real NVP. In ICLR, 2017.
[12] Dormand, J. and Prince, A family embedded runge-kutta formulae. Journal of Computa- tional and Applied Mathematics, 6(1):19 26, 1980.
[13] Esteban, C., Hyland, L. S., and Rätsch, G. Real-valued (medical) time series generation with recurrent conditional gans, 2017.
[14] FOLLAND, G. B. Introduction to Partial Differential Equations: Second Edition, volume 102.
Princeton University Press, 1995.
[15] Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B.. Warde-Farley. D., Ozair, S., Courville, A.. and Bengio, Y. Generative adversarial nets. In NeurIPS. 2014.
[16] Grathwohl, W., Chen, R. T. Q., Bettencourt, J., Sutskever, I., and Duvenaud, D. Ffjord: fore-form continuous dynamics for scalable reversible generative models. In ICLR, 2019.
[17] Grover, A., Dhar, M., and Ermon, S. Flow-gan: Combining maximum likelihood and adversarial learning in generative models. In AAAI, 2018
[18] Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., and Courville, A. Improved training of wasserstein gans. In NewrIPS, 2017.
10

---

[19] Hutchinson, M. A stochastic estimator of the trace of the influence matrix for laplacian smoothing splines. Communications Statistics Simulation and Computation, 19(2). 1990.
[20] Ishfaq. H., Hoogi, A., and Rubin, D. Tvae: Triplet-basdd variational autoencoder using metric learning, 2018.
[21] Jordon, J., Yoon, J., and Schaar, V. D. M. Pate-gan gane Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations. 2019.
[22] Kelwin Fernandes. Online News Popularity Data Set. htttp::/arrchive.ccs..uut wdu.m.ii..emmmmmm...
dateaeets//vantyyleesssrgggg 2015.
[23] King County. House Sales in King County, USA. housesalleppediittion 2021.
[24] Kingma, D. and Welling, M. Auto-encoding variational bayes. ICI.R, 2014.
[25] Kingma, D. P., Salimans, T., Jozefowicz, R., Chen, X., Sutskever, L., and Welling, M. Improved variational inference with inverse autoregressive flow. In NeurlPS, 2016.
[26] Oliva, J., Dubey, A., Zaheer, M., Poczos, B., Salakhutdinov, R., Xing, E., and Schneider, J. Transformation autoregressive networks. In ICMI. 2018.
[27] Park, N., Mohammadi, M., Gorde, K., Jajodia, S., Park, H., and Kim, Y. Data synthesis based on generative adversarial networks. 2018.
[28] Patel, S., Kakadiya, A., Mehta, M., Derasari, R., Patel, R., and Gandhi, R. Correlated discrete data generation using adversarial training. 2018.
[29] Patki, N., Wedge, R., and Veeramachaneni, K. The synthetic data vault. In DSAA, 2016.
[30] Reiter, P. J. Using cart to generate partially synthetic, public use microdata. Journal of Official Statistics, 21:441, 01 2005.
[31] Rezende, D. and Mohamed, S. Variational inference with normalizing flows. volume 37 of Proceedings of Machine Learning Research, pp. 1530-1538, 2015.
[32] Ronny Kohavi. Adult Data Set. http:///rrcaaee...c......eeeae/s 1996.
[33] Ronny Kohavi. Census Income Data Set. census+income 1996.
[34] Sigma Cabs. Trip Pricing with Taxi Mobility Analytics. https://www.kaglle. /om 2021.
[35] Srivastava, A., Valkov, L., Russell, C., Gutmann, M. U., and Sutton, C. Veegan: Reducing mode collapse in gans using implicit variational learning. In NeurIPS. 2017.
[36] van den Berg, R., Hasenclever, L., Tomczak, J., and Welling, M. Sylvester normalizing flows for variational inference. In UAI, 2018
[37] van der Maaten, L. and Hinton, G. Visualizing data using t-sne. Journal of Machine Learning Research, 986), 2008
[38] Xu, L., Skoularidou, M., Cuesta-Infante, A., and Veeramachaneni. K. Modeling tabular data using conditional gan. In NeurIPS. 2019.
[39] Yoon, J., Jarrett, D., and van der Schaar, M. Time-series generative adversarial networks. In NeurlPS, 2019.
[40] Zaur Begiev. Bank Loan Status Dataset. https:/www.kaglle.con//auuu
my- wwy_datasst7seleec=crddtt train. csv) 2017.
[41] Zhang, J., Xiao, X., and Xie, X. Privtree: differentially private algorithm for hierarchical decompositions. 2016.
[42] Zhang, J., Cormode, G., Procopiue, C. M., Srivastava, D., and Xiao, X. Privbayes: Private data release via bayesian networks. ACM Transactions Database Systems, 2017.
11


Reviews:
[{"review_id": "ntnjWgvEqD", "reviewer": "Reviewer_1ZTc", "summary": "This paper proposes a new GAN framework for tabular data synthesis, which combines the adversarial training of GAN and negative-log density regularization of invertible networks. The negative-log density regularization enables the trade-off between synthetic quality or privacy protection. Specifically, the G is designed via the motivation of NODE to estimate the invertible latent vector from the hidden representation. The AE is trained to encode the hidden representation of real samples and GAN is trained via the hidden representation instead of raw data. ", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros \n\nThe paper is nicely written and easy to read. The proposed model is technically new to me and achieves state-of-the-art results on benchmark datasets. \n\nCons \n\nHowever, the paper discusses the overall performance of the proposed model with the best hyper-parameters. It would be more useful to readers to have an ablation study on them. \n\nMoreover, the proposed model is a bit different from the standard GAN model, thus one needs to understand how much each proposed component contributes to the performance.\n\nMinor mistake in Line 279: periodD, periodG, periodL in Algorithm 1, are in {1, 3, 5, 6}.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors adequately addressed the limitations and potential negative societal impact of their work.", "review_text": "", "extra_scores": {"ethical_concerns": "N/A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "Three hours"}, "extra_text": {}}, {"review_id": "dVwl9BQ3BZ", "reviewer": "Reviewer_vTau", "summary": "The paper proposes a new architecture for tabular data synthesis. In particular, the proposed architecture utilizes a combination of autoencoders (AEs), generative adversarial networks (GANs), and invertible models. The architecture can also consider aspects of privacy via a hyperparameter which controls the likelihood of the generator producing data from the training set.\n\nMain Contributions:\n  - The proposed architecture, utilizes an AE to first change inputs into a latent dimension for the GAN to then process.\n  - The invertible model is utilized in the generator of the GAN -> This ensures that the latent representation of the AE agrees with the invertible generator (such that there exists an input to the generator which will produce the true latent representation of an AE input)\n  - Furthermore, the random generator inputs induce a pdf -> which gives a pdf on the (reconstructed) AE latent space generated by the generator network (via invertibility). This can thus be used as a regularization condition to penalise/reward the likelihood of training data's latent representations generated by the generator network.\n  - The following is experimentally tested using a number of datasets and against a number of baselines, with better reported performance.\n  - A privacy experiment is done. Here, the closeness of generated data to training data is evaluated.", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Overall the paper, provides a novel architecture which combines a number of different ideas for synthesising tabular data. The paper is well written and clear. The ideas composition of previous architectures is also interesting. The only notable flaw is that the angle in which privacy is examined is only examined experimentally with no theoretic analysis. However, the large coverage of experiments helps provide evidence for this approach.\n\nOriginality & Significance: Although the individual components of the architecture are not novel, their composition appears to be. One fact which could hurt novelty is if the composition of AE and GAN has been used before. If so, this should be highlighted in prior work. The use of the invertible generator is also very interesting.\n\nQuality & Clarity: The paper seems to be technically sound with a nice and extensive experimental section. The only issue is the lack of runtime and architecture size comparisons. The paper is also well written. Although the heavy notation in the specification of the architecture hurts clarity a bit.\n\nStrengths:\n  - The combination of AE, GAN, and invertible generator is neat.\n  - The log-density likelihood regularizer/loss function is interesting. It seems that this can also be used to make different partitions of real world data more likely (i.e., create a specialized generator by rewarding/penalizing different subsets of the training data).\n\nWeaknesses/Suggestions/Questions:\n  - The notation of the loss function in (9) suggest that the regularity/sparsity terms only depend on the fake data. If so, why not have this also depend on the training data/real records?\n  - What is the runtime compared to baselines? How does your proposed architecture compare in the number of parameters to baselines?\n  - Is there a way to relate the log-density regularizer and the fake-real distance other definitions of privacy? (differential privacy?)\n  - There seems to be a missing point of comparison when the log-density regularizer is not used. What happens when you don't use an invertible generator?\n  - Furthermore, without the invertible generator can the log-density regularizer be substituted by just considering a convex reweighting of the discriminator error for real and fake error? (i.e., for $ \\gamma > 0 $, weight the error of discriminator for realdata being lower than that of an error for fake data)", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors have adequately addressed the limitations and potential negative societal impact of their work.", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "bmDuAIrEqLV", "reviewer": "Reviewer_uc8f", "summary": "The authors present a generalised GAN framework for tabular synthesis wherein, with a view towards privacy, the Negative Log Likelihood (NLL) of the synthesised dataset can be tuned. The authors evaluate this technique of likelihood tuning with regards to tradeoffs in downstream tasks and privacy attacks. To evaluate the NLL the authors are required to use an invertible network, which imposes dimensionality constraints. To overcome these constraints the authors first push the data to a lower-dimensional, latent space using an auto encoder, on which the GAN is trained. ", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "While the problem and method of anonymising tabular data using a GAN appears not to be new, the proposed technique of using the NLL to guard against privacy techniques seems original. The account of the existing literature is thorough and the contribution of the authors is well defined.\n\nThe authors give cursory theoretical considerations to several aspects of their approach, in particular the time complexity for the Jacobean determinant calculations and suitably of the algorithms to solve the associated ODE problem. The experimental results are well presented, and the authors' approach appears to significantly outperform other techniques with respect to synthesising tabular data and defending against privacy attacks.\n\nThe work is very clearly written and concisely.\n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors address some limitations of their approach with regards to developing synthetic datasets realistic enough to train models with the same accuracy as the original datasets. But these limitations are not unique to this work, and are likely a larger problem beyond the scope of this paper.\n\nOne question I had reading the paper was the necessity of the VAE to develop the low dimensional encoding on which the GAN is trained. Do you have any experiments showing the benefit of this added complexity? Is it feasible to compute the Jacobean determinant in the original dimension space?", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "1"}, "extra_text": {}}, {"review_id": "EHfdXa9Z1YG", "reviewer": "Reviewer_ydPV", "summary": "This paper proposes the invertible tabular GAN framework which contains an auto encoder to encode the data into a vector representation, and an invertible generator to generate such representation. The invertibility of the generator enables the computation of likelihood for real data, and the likelihood can be used as a regularization to the network. \n", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Originality: \n- The idea of introducing invertible neural networks into synthetic data generation is a novel and interesting idea. \n- However, the IT-GAN model only learns the pdf for the hidden vector generated by the auto-encoder, rather than the tabular data itself. Thus does not solve the fundamental challenge in learning the probability distribution of tabular data. \n\nQuality:\n- The performance of the proposed model has been carefully evaluated on multiple real-world datasets and compared with strong baselines. - The results show that the proposed method can outperform existing methods, and on some metrics with a large margin. \n- The experiments are well-designed, including the privacy attack experiment and the distance distribution table, which can clearly show the effect of decreasing likelihood. \nClarity:\n- This paper is clearly written and well-organized. Experimental settings and results are listed and code is available. \n\nSignificance:\n- Although the proposed method is somewhat incremental, bringing invertible neural networks to model the probability distribution and generate synthetic data at the same time is a non-trivial idea. Such work is inspiring for future research and beneficial for the field. \n\nMinors:\n- Footnote 1: It is well known that VAEs generate blurred samples but achieve a better log-density than GANs. Such observation is made on images, while tabular data may be different. \n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "I don’t think this work can lead to any negative social impact. \n", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers have come to an agreement that the paper is both original in content and provides a through experimental development of the technique, with adequate comparisons to strong baselines.

Even when already polished, I would still recommend to try to polish a bit further the narrative in regards to the discussion with RvTau and your reply to 1ZTc. The approach is sophisticated and could benefit from it.

AC.

Decision: Accept (Poster)