Robust Concept Erasure via Kernelized Rate-Distortion Maximization
Authors: Somnath Basu Roy Chowdhury
Nicholas Monath
Kumar Avinava Dubey
Amr Ahmed
Snigdha Chaturvedi
Venue: NeurIPS 2023 poster (2023)
Keywords: Concept Erasure
Representation Learning
Rate distortion
Fairness
Debiasing

Abstract: Distributed representations provide a vector space that captures meaningful relationships between data instances. The distributed nature of these representations, however, entangles together multiple attributes or concepts of data instances (e.g., the topic or sentiment of a text, characteristics of the author (age, gender, etc), etc).  Recent work has proposed the task of concept erasure, in which rather than making a concept predictable, the goal is to remove an attribute from distributed representations while retaining other information from the original representation space as much as possible.  In this paper, we propose a new distance metric learning-based objective, the Kernelized Rate-Distortion Maximizer (KRaM), for performing concept erasure. KRaM fits a transformation of representations to match a specified distance measure (defined by a labeled concept to erase) using a modified rate-distortion function. Specifically, KRaM's objective function aims to make instances with similar concept labels dissimilar in the learned representation space while retaining other information.  We find that optimizing KRaM effectively erases various types of concepts—categorical, continuous, and vector-valued variables—from data representations across diverse domains. We also provide a theoretical analysis of several properties of KRaM's objective. To assess the quality of the learned representations, we propose an alignment score to evaluate their similarity with the original representation space. Additionally, we conduct experiments to showcase KRaM's efficacy in various settings, from erasing binary gender variables in word embeddings to vector-valued variables in GPT-3 representations.

Robust Concept Erasure via Kernelized Rate-Distortion Maximization
Somnath Basu Roy Chowdhury UNC Chapel Hill
Nicholas Monath Google DeepMind
Avinava Dubey Google Research
Amr Ahmed Google Research
Snigdha Chaturvedi UNC Chapel Hill
{somnath, snigdha)@cs. wnc. edu
{nmonath, avinavadubey, amra/@google.com com
Abstract
Distributed representations provide vector space that captures meaningful rela- tionships between data instances. The distributed nature of these representations, however, entangles together multiple attributes or concepts of data instances (e.g., the topic or sentiment of text, characteristics of the author (age, gender, etc), etc). Recent work has proposed the task of concept erasure [50, 52], in which rather than making concept predictable. the goal is remove an attribute from distributed representations while retaining other information from the original representation space as much as possible. this paper, we propose a new distance metric learning- based objective, the Kernelized Dist-Diitottoon Maximizer (KRaM), for performing concept erasure. KRaM fits a transformation of representations to match a specified distance measure (defined by labeled concept to erase) using a modified rate- distortion function. Specifically, KRaM's objective function aims to make instances with similar concept labels dissimilar in the learned representation space while retaining other information. We find that optimizing KRaM effectively erases various types of concepts categorical, continuous, and vector- vector-valued variables- from data representations across diverse domains. We also provide a theoretical analysis of several properties of KRaM's objective. To assess the quality of the learned representations, we propose an alignment score to evaluate their similarity with the original representation space. Additionally, KRaM's efficacy in various settings, from erasing binary gender variables in word embeddings vector-valued variables GPT-3 representations.
conduct experiments showcase
Introduction
Learned representations, particularly distributed representations [30], are at the core of machine learning with applications in natural language [39], images [21]. biology [4], physics [3], and several other domains [40, 48]. These vector-based representations of data instances create an inner product space where similarities and nearest-neighhor relationships are "meaningful". However, due to the distributed nature of these representations, the definition of "meaningful" is often not easily discernible. In other words, shared properties of data instances nearby in the vector space not always evident. These shared properties are often referred to as concepts [31]. For instance, concepts representations images include objects in the image, whether is indoor or outdoor, etc. Similarly, concepts in text representations include the topics, and characteristics of the author (c.g.. geographic location, gender, etc.). For applications that necessitate conditioning on specific attributes to make or explain predictions, these distributed representations can pose challenges. Consequently,
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

significant body of work has focused on jointly learning representations and disentangling their underlying concepts [28, 29].
However, state-of-the-art representations for tasks across various domains often come from pre- trained models (e.g., ViTss [23] for images, GPT [14] for text, among others). In many cases, these pre-trained representations are utilized directly without fine-tuning the original model, due to factors such as computational burden limited model API access [24]. This presents a challenge for fitting disentangled representations of data instances and their concepts since the model parameters are frozen. Rather, it presents an opportunity for learning a transformation (or similarly learning a distance metric) for the pre-trained representations.
While learning such transformation of pre pre-tedined representations can be used for many applications (e.g., classification, regression, etc.) that involve disentangling specific concepts from representations, focus the recently proposed task of concept erasure [50]. The objective of concept erasure twofold: (1) to learn representations that minimize the classification accuracy (or mean squared error) for a specific concept variable and (2) to retain as much other information from the original representations as possible. This becomes possible when the representations are not correlated with the concept variable. We should note that there are indeed some trivial methods reduce the correlation - suchh as generating random representations or making all representations identical. However. these solutions fail to retain any information from the original representation space. This highlights one of the key challenges in concept erasure retaining information from the original space while removing given concept. This challenge is accentuated by the lack of a pre-specified downstream task for which the representations could be optimized. Instead, objectives for concept erasure use no supervision (apart from the labels of the concept to erase). This makes it difficult to use adversarial learning [60] or mutual information estimation [17, 43] methods for concept erasure.
The independence of concept erasure from down-stream tasks makes it amenable to a variety of applications that use the modified representations. For example, when developing a toxicity classifier for online comments, an organization may seek ensure that content from different religious backgrounds is treated equitably. This can be achieved using concept erasure to remove information about religion from the text representations [60]. Concept erasure has also shown promise in of large models by studying counterfactual scenarios where certain
interpreting the decision-makee properties of the input are erased from intermediate layers [26].
In this paper, we present a new distance metric learning- based objective for concept erasure. We refer to our objective, Kernelized Rate-Distortion Maximizer (KRaM). The objective fits transformation of representations to match a specified distance measure using kernelized rate-distortion function, where the kernel is constructed using concept labels. Specifically, KRaM's objective function tries to make instances with similar concept labels dissimilar in the learned representation space (Figure 1). Empirically, we find that optimizing KRaM results in representations that are uncorrelated with the concept variable, effectively leading to its erasure. To evaluate the quality of the representations, we propose a k-nearest neighbour based measure capture the alignment of the learned representations with the original representation space. We conduct extensive experiments to demonstrate that KRaM is capable of erasing various types of variables from data representations across a wide range of domains. We also theoretically analyze several properties of the proposed objective function. Our primary contributions are:
continuous, and vector-values
We introduce novel framework KRAM, which uses kernelized formulation of the rate- rate-distortion function that is able to delete a range of concepts - categorical, continuous, or vector-valued variables from representations (Section 3).
We propose a computationally efficient alignment measure, to evaluate how informative the learned representations about the original representation space (Section 4).
We perform a theoretical analysis of KRaM's objective and alignment measure. We conduct extensive experiments to showcase the efficacy of KRaM in a range of settings, from erasing binary gender variables in word embeddings to vector-valued variables in GPT-3 representations (Section 5).
2 Preliminaries & Background
In this section, we first formally describe the concept erasure setup, then discuss some prior concept erasure techniques, and finally introduce the fundamentals of rate-distortion theory.

---

Problem Setup. In concept erasure [50, 52], we consider the input representations E X and the concept A as random variables. We assume access to samples [(2), a1), (22. a2).... drawn from the joint distribution P(X, A). The goal of concept erasure is to learn function f()) that generates representations [f(m1), [(x2)..... E 2, such that it is infeasible to predict the concept labels a E A from 2. In addition to erasing the concept variable, f(x)) E 2 should retain as much information about z E X' as possible. We do not impose any constraints on the nature of the concept. It can be: categorical (a E [k]), continuous (a E R), or vector-valued (a E E²) random variable.
Concept Erasure is also closely related to learning invariant representations with respect to an attribute through adversarial learning [8, 25, 32, 60]. However, concept erasure differs from adversarial learning in two key aspects: (a) the input representations E X remain frozen during the concept erasure process (only erasure function f is updated), and (b) it does not rely on a specific downstream task. This setup is heneficial in situations where we can access representations but lack the necessary resources or infrastructure to train or fine-tune the model that generated them. In the following section, we describe the details of the proposed concept erasure framework, KRaM.
Prior Work. Concept erasure was initially introduced by [13] in the context of removing binary gender labels from GloVe embeddings [46]. Initial works on this problem [13, 49] performed concept erasure by projecting representations onto the null space of the optimal separating linear subspace for the categorical concept. Recent work [50] has introduced a generalized objective for this solution, presenting it as a minimax game between concept identification and nullspace projection, and further provided a closed-form solution for its relaxed convex version. Nonetheless, these techniques are limited by two main assumptions: (a) the erasure function f() is linear, and (b) the concept variable categorical. linear erasure function ensures that a linear subspace, which could identify the concept label for instances, does not exist in the learned representation space, 2. Consequently, it prevents any linear network from extracting the concept labels from the learned representations. However, it can still be possible for non-linear network to predict the concept labels by identifying non-linear concept subspace. Given that most modern ML architectures rely on non-linear networks, it is crucial to ensure that the concept is inaccessible to non-linear networks. More recent works have made progress towards non-linear concept erasure. This has been done either by using a linear concept erasure after projecting the input into a non-linear feature space [52], directly utilizing a non-linear crasure function f using a rate-distortion objective [18]. Despite their potential, these concept erasure techniques require access to categorical concept labels for all instances. Hence, it is not possible to erase other forms of concept variables (continuous or vector-valued) using these techniques without discretization of the concept labels, which often leads to information loss. In contrast to these techniques, our erasure framework KRaM is able to handle a variety of concept variables (categorical, continuous, vector-valued) while performing non-linear concept erasure. This becomes possible as KRaM presumes access to a kernel matrix that is defined by the concept labels, and does not impose any additional constraints on the nature of the concept variable. Next, we discuss the fundamentals of the rate- distoritto function that forms a building block of our framework.
Rate Distortion. In information theory [20]. the compactness of distribution is measured by their coding length - the number of binary bits required to encode it. In lossy data compression, a set of vectors 2 (21,...,, 2n } Randd sampled from distribution P(Z), is encoded using a coding scheme, such that the transmitted vectors { can be recovered up to a distortion c. The minimal number of bits required per vector encode the sequence Z is defined by the rate-distortion function R(Z,e). The optimal R(Z,e e) for vectors Z sampled from a multivariate Gaussian N(0, Σ) is:
R(Z,c) 2
logg det [ ne²
d
2zT)
where n is the number of vectors and d is the dimension of individual vectors. Equation 1 provides a tight bound even in cases where the underlying distribution P(Z)) is degenerate [38]. The rate- distortion function is also closely tied to the sphere packing problem [38] and represents the volume (or intrinsic dimension) of a representation set. Recent works like MCR [59] have built on the rate- distortion function to learn discriminative representations for classification tasks. Concept erasure techniques [18, 19], have also used the rate-distortion function to erase categorical variables. Even though KRaM uses the rate-distortion function similar to these techniques, it is more versatile and capable of erasing different types of concept variables. KRaM also imposes additional constraints on the feature space to ensure robust concept crasure, which we discuss in the following section.
3

---

(a) Original
(b) Large R(Z)
(c) Small R(Z)
(d) KRaM
R(Z)
LLM
R(Z] K)
max RCZ (K)
max R(Z) R(2) max R(Z K) 2 2| - bl
Figure 1: An illustration of concept crasure using KRaM, Input representations are retrieved from large language model. The original representations (a) encodes binary concept variable (the two classes are shown in @ and ). which we aim to erase. R( 2 K) term forces instances from the same class to move apart. However, for robust concept erasure the size of the representation space R(Z) matters, which we illustrate visually in (b), (c), and (d). KRaM enforces the constraint R(Z) to erase the concept while retaining information from original representations.
3 Kernelized Rate-Distortion Maximizer (KRaM)
We proceed by discussing how a concept variable can be erased from representation set. A concept cannot be extracted by a predictive network (which is equivalent to erasure) if there is minimal correlation between the representation set, Z, and the concepts, A [58]. Note that distances in the representation space can be indicative of the concept variable. For example, in Figure 1 (a) we observe that instances in the original representation space with similar concept labels (shown by their color @ and @) appear close to each other. Here, the distance between instances is correlated with the concept label, thereby making it feasible identify the concept labels via a linear or non-linear boundary. Ideally, we want a representation space where distances are not reflective of concept labels, where instances with different concept labels appear together (e.g., Figure (c) & (d)).
The intuition behind our approach, KRaM, is to make the distances in the learned representation space, Z, uncorrelated with the concept variable, A. Specifically, we try make instance pairs similar in the concept space to be distant (or dissimilar) in the learned representation space, Z. We achieve this by learning erasure function f (parameterized by neural network) transform the input X into Z. We propose a kernelized formulation of the rate-distortion function to train f:
R(2(K) 2
log2 det [+ ne²
2Z + (K)
(2)
where = ((x) E RRaxd and the kernel matrix, K E TRaxn, captures similarities between concept labels. The entries of the kernel matrix are inversely proportional to the distance between concept labels K,, x 1/d(a,, aj). where d(.,.) can be an arbitrary symmetric distance function, such that d(z, 0. We observe that R 2 (K) is sensitive to the scale of the representations f(z) E Z. Therefore, we fix the Frobenius norm of the representations using a layer normalization layer [5] to make fz) Sd. ensuring that individual instances have equal impact the loss.
Next, we discuss how maximizing R (Equation 2) helps in concept erasure. We proceed by noting that maximizing the standard version of the rate-distortion function (Equation 1) is equivalent to increasing the covariance of the representations, Zz. In the kernelized rate-distortion function (Equation 2), we observe that the kernel matrix K assigns higher weights to instance pairs that have similar concept labels (K,, x 1/d(a, az)). Intuitively, this means that maximizing R(Z ()) results in an increased dissimilarity between instance pairs with similar concept labels, illustrated by the arrows in the center of Figure (a). This gradually leads to the distances in the learned representation space Z being unrelated to the concept labels.
However, simply maximizing R K) may not guarantee robust concept erasure without imposing additional constraints on the overall feature space. We explain why this happens by considering few scenarios. First, consider the scenario where we do not impose any constraints on the feature space, shown in Figure (bb). In this scenario, the volume (or intrinsic dimension) of the feature space (analogous to R(2) term) also expands as R( 2 ([ is maximized (Lemma 1). Here, we observe that even though the mntra-group distances have increased it is still possible to separate the two groups

---

using a non-linear decision boundary. Second, we consider the scenario where we try to minimize the volume of the feature space, which equivalent to minimizing R(2), This is illustrated in Figure I(c), where all instances are pushed together making it hard to predict the concept labels. However, it also results in a significant loss of information from the original representations (as the volume or intrinsic dimension collapses). As different instances become almost similar it destroys the unique features present in Figure (a), potentially rendering them ineffective for downstream tasks. Thus, appears that the optimal approach is to maintain constant size of the feature space as illustrated in Figure ((d), We verify these scenarios empirically in Section 5.2. With this consideration, we present the following objective:
max R 2 K), subject to R(2) = b.
where = (() is the initial number of bits required to encode the data and Z = f(²). In practice, found that satisfying the equality R(2) b using Lagrangian function hinders the maximization of R R2 k). For concept erasure, we only want the feature space volume to be constant and do not require it to exactly be b. Therefore, optimize relaxed version of the objective (Equation 3):
max R(2 A|R(Z)) - b],
where À is a hyperparameter. The second term in Equation 4 penalizes the network, f. if the overall volume R(Z) deviates too far from b. Depending on the nature of the attribute (categorical, continuous, or vector-valued), the user can define the kernel matrix K between concept labels. For categorical concept variables. in our experiments, we the kernel matrix whose values Kiy E 10. where K;j 1 if a; =a, otherwise Kij = O. For continuous and vector-valued variables, the kernel matrix can be derived from the concept labels by using a suitable kernel function (e.g., Gaussian, Laplacian, or Cauchy kernels) if it is not specified by the user. In our experiments, we use a Gaussian (RBF) kernel function for continuous and vector-values valued concepts.
Lemma (General Bounds for R( R(2) For any set of representations 2 E Raxd, a kernel matrix K E Rx using kernel function satisfying k(x, x) = 1 and e > 0, it holds that:
S n log, (1 + d/ne²).
R(2) < R(Z
(5)
2
where the first equality is satisfied when K 11T and the second equality when ZZ I.
The detailed proof is provided in Appendix A. This result shows that R(2(K) has lower bound equal to the rate-distortion function of the representations with the upper bound being independent of the kernel matrix. We empirically show that maximizing R( 2 K) also results in an increase in R(2) in Section 5.2. Using the results of the above lemma, we can show that the proposed objective (Equation 4) is bounded in the following corollary.
Corollary 1. Using assumptions in Lemma 1, for À E [0, 1] the objective functioon (Equation 4) is bounded between Ab, max {(1 + AYU Ab, (1 X)U + (b3], where U = log2 (1 - d/ne²)
4 Measuring Alignment
limitation prior works [18, 49, 50] is the lack of evaluation beyond proxy tasks of how information preserved by the learned representations Z about the original representations X. which we refer to as alignment. An erasure framework that generates random representations able to erase concept A perfectly but does not retain any information from X. Therefore, it is important measure the alignment as well while optimizing the erasure function f. To this end, we propose a computationally efficient measure by computing the overlap between k-nearest neighbour sets of X and Z. The average nearest neighbour overlap across all representations is the alignment score (AA)) for a given concept erasure function f:
Ax E. [[kun(x)) O /k) 200
where knn(-) function computes the k-nearest neighbour set of a representation. Alignment scores lie between (f) E [k/n, 1] (Lemma 2). Notice that this measure quite similar to non-parametric approaches for mutual information (MI) estimation [41, 35]. These methods, while leveraging nearest neighbour information, compute data statistics within hypercube. However, these MI
5

---

estimates are often biased for high-ding -igeesiienii data [27]. In contrast to these methods, we utilize the bijective mapping (erasure function f') between X' and 2 (which not available in the general case of MI estimation) to compute the overlap between nearest neighbour sets. The computation of A& can be made faster using an efficient nearest neighbour data structure like kd-tree [10]. Note that a similar measure was used to determine the stability of word embeddings [57].
k=1% (r=0.95)
k= (r=0.99)
10%% 0.98)
km 90% (r=0.99)
k= 30%
(r= 0.99)
Accuracy
5-5% (r- 0.99)
1.0
0.8
0.6
Empirically, we find that A is well correlated with the downstream performance of Z. Specifically, we perform a synthetic experiment to simulate concept erasure and assess the efficacy of A₁ in capturing the alignment of 2, where we sample a representation set (x ~ IR 100 and their corresponding labels. We remove information from these representations by projecting them onto nullspaces of its dominant eigenvectors (de- tails provided in Algorithm 1). During this process, we measure the prediction accuracy for the original labels and A₂ scores (shown in Figure 2). We find the Aş is highly correlated with the prediction accuracy achieving Pearson correlation scores 0.99 (the average correlation over multiple runs). We also compare Aş with a few different alignment measures (including MI estimates) and find that our method outperforms others (more details in Appendix B).
0.2
0.0
20
40
80
100
Projection Count
Figure 2: Correlation of alignment score, A& with accuracy for synthetic dataset. For different & values, (& achieve high Pearson correlation ~0.99.
Lemma (Aligmment for random representations), Expected alignment score achieved by a concept erasure frumework that generates random representations is [[Aa(J)) k/n.
The proof is provided in Appendix A.2.
This result shows the importance of choosing k. If k is too small, the Af( scores may be low for many concept erasure functions. Conversely, k R n, then the (f( scores will almost always be close to 1. In our experiments (Figure 2), we find that A As correlation is maximized when k- = 0.5m.
5 Evaluation
In this section, we provide the specifics of the experimental setup and evaluation results for concept erasure using KRaM across various datasets. The implementation of KRaM is publicly available at https:// gi thub. com/ wwwm/brcsomnath//eeo /KRMM.
Setup. In all settings, we follow the same routine for concept erasure: (a) we obtain representations either directly from the dataset or an encoder (e.g., BERT, GPT-3), which are kept frozen; (b) we perform concept crasure in a post-hoc manner to obtain representations f(z) E Z, where f is non-linear neural network; and (c) we use f(x) on downstream tasks and report the metries.
Datasets. We assess the effecttivneess of KRaM in erasing 3 types of concept variables: (a) categorical concepts - we apply KRaM erase binary gender variables from Glo Ve embeddings and race from BERT embeddings for tweets in the DIAL dataset [7]: (b) continuous concepts we evaluate KRaM on a synthetic dataset, generated using continuous latent variable, and UCI Crimes [36]. For these datasets, we treat one of the latent continuous variables and African American (AAE) population ratio as the concepts to be erased, respectively; (c) vector-valued concepts we evaluate on Jigsaw toxicity detection dataset [1], where we consider religion and gender (which are vector-valued variables) as the concepts to be erased from GPT-3.5 [15] embeddings. We present additional details in Appendix C.
Baselines. We compare KRaM with the following baselines: (a) INLP [49] (linear) iteratively projects
representations onto the nullspace of optimal separating linear subspaces; (b) RLACE [50] (linear)
is an extension of INLP that performs concept erasure by solving minimax game; (c) KCE [51]
(non-linear) presents a kernelized version of the minimax game introduced in RLACE; (d) FaRM [18]
(non-linear) employs rate-disten dieetoitooioonn maximization for erasing categorical concepts (e) KRaMannar uses KRaM's with a linear erasure function f. To the best of our knowledge, there are no existing methods for continuous or vector-valued concept erasure. For continuous concepts, we normalize the labels and quantize them into ni, bins (a hyperparameter). We denote a concept erasure method as Methodo whenever guantization is used. For vector-valued concepts, we extend nullspace projection based

---

Original
RLACE, INLP
KRah
Original
KRaM
0.012
MSE ( better)
0.12
360 better)
0.010
0.10
0.008
0.006
0.004
0.03
0.002
0.00
0.000
Buddhist
Hindu
Jewish
Figure 3: Vector-valued concept (religion) erasure performance using KRaM on Jigsaw toxicity dataset.
KRaM achieves better performance (1 MSE & AGDP) than baseline approaches in most settings.
crasure techniques by quantizing each dimension and projecting onto a series of nullspaces. is unclear how to utilize nn--projection-bsee methods for vector-valued concept erasure.
Metrics. Following previous work [18, 50], we assess concept erasure quality using the following:
Probing representations. We use scikit-learn MLP classifier (non-linear) [45] to probe f(z). report classification accuracy for categorical attributes, MSE for continuous and vector-valued attributes (in a dimension-wer -iiiese manner). A better concept erasure method would have low accuracy and a high MSE for the deleted concept.
Downstream metrics. For datasets with a downstream task, we evaluate the deleted concept still affects the task by measuring statistical parity. We report DP for categorical concepts, AGDP [33] (see Appendix C.2) for continuous concepts, and AGDP values for each dimension of vector-valued concepts. Lower statistical parity scores are expected after concept erasure. However, note that concept erasure does not necessarily guarantee fairness [16]. Applying these methods for fairness would require
ieplicattionspeciffi analysis of the risks and biases.
Alignment. We report the alignment scores (Aę for k 0.5m, therefore A E [0.5, 1)) wherever downstream task is absent. Higher As scores are expected. If downstream task is available, we probe (I) for that task, where we expect high accuracy or low MSE scores.
5.1 Main Results
In this section, we report the performance of KRaM in erasing different types of concepts: categorical, continuous, and vector-value variables. Note that the primary objective of concept erasure is to robustly erase the concept variable (by achieving lower probing and fairness metrics) even if that reduces the utility of the representations to some extent. This different from adversarial learning where we try to achieve balance between faimesss and utility. In our experiments, we show KRaM is able to robustly erase concepts while retaining significant amount of original information.
Vector-valued Concept Erasure. Erasure of vector-valued concepts is useful when the attribute deleted not available the form of categorical or normalized continuous variable. We evaluate KRaM on erasing information about religion, a vector-valued concept, in the Jigsaw toxicity dataset [1], where the downstream task involves detecting whether an online comment is toxie. Each text is annotated with vector valued concept: religion with scores over the categories (f budddiss'', 'christian', 'hindu', 'jewish'' 'muslim', 'others')) }). We obtain text representations from GPT-3.5 API and use RBF kernel with cosine distance function. In Figure 3, we report the MSE and AGDP scores for KRaM along with other baselines. We observe that KRaM performs best achieving low AGDP with high MSE scores across most concept labels. We also observe that the change in toxicity classification accuracy (93.2% - 92.1 (%) is minimal during concept crasure. This showcases the efficacy of KRaM in erasing vector-valued attributes it achieves up to 76% MSE gains over the best baselines. We also report the results for vector- vector-valued gender crasure in Appendix D.
Continuous Concept Erasure. We evaluate the efficacy of KRaM in erasing continuous concepts on synthetic dataset and UCI Crimes. We compare with baseline approaches that use quantized concept labels. In Table 1 (left), we report the results on the synthetic dataset and observe that KRaM performs the best preventing leakage of a (high MSE scores) while achieving considerable alignment score, Ag. While both FaRM and KRaM utilize non-linear erasure functions, a necessity for robust concept erasure, they tend to achieve relatively lower A scores. Despite this, it is important to note that significant information can still be preserved through non- non-lincar warping, which show
7

---

Synthetic
UCI Crimes
Method
MSE (a)
Ap 1
Rank f
MSE (y) 4
MSE (o)
AGDP J
As t
Original
0.006
1.0
100
0.046
0.030
0.058
1.0
Random
0.174
0.50
100
0.211
0.251
0.006
0.50
INLPo [49]
0.084 T
0.85
100
0.055 T
0.056
0.0 -
0.90 T
RLACEe [50]
0.021
0.87
100
0.038
0.022
0.051
0,81
FaRMo [18]
0.068
0.74
100
0.050
0.064 T
0.013 1
0.62 T
KRaM
0.109 T
0.67
100
0.069
0.104
0.001
0.59
KRaMunear
0.083 T
0.75
100
0.067
0.082
0.022
0.69
Table I: Continuous concept erasure: We evaluate the synthetic and UCI Crimes. Post concept erasure using KRaM, we observe a significant increase in MSE (a) combined with a drop AGDP.
DIAL
Glove
Method
Acc. (y)
Acc. (a) $
DP
Acc. (a) 4
A f
Rank
Original
75.5
87.7
0.26
100.0
1.0
300
Random
50.8
50.5
0.01
50.2
0.50
300
INLP [49]
75.1 T
69.5
0.16
86.3
0.85
210
RLACE [50]
75.5 T
82.1
0.18
95.5
0.93 T
300 1
KCE [51]
75.0
80.1
0.12 +
63.5 1
0,62
100
FaRM [18]
74.8
54.2 T
0.09 T
53.9 T
0,65
247 T
KRaM
72.4
54.0 T
0.08 T
52.6
0.65
KRaMunear
75.4
67.5 T
0.18
67.0
0.73
130
Table 2: Categorical concept erasure: We assess binary gender and race erasure from GloVe and BERT representations (from DIAL.) respectively. denote the top 3 results for any metric using 2, and T respectively. Desired trends for all metrics are shown using or
in the categorical experiments. Note that linear erasure functions are able to retain nearest neighbour structures better, thereby achieving higher Aş scores. In Figure 5, visualize the UMAP projection of synthetic data, where the representations' position is indicative of the latent continuous concept attribute prior concept erasure (left). Post concept erasure (right), observe no such discernible correlation. For UCI Crimes, we perform erasure for the African-American (AAE) population ratio, predict the normalized number of crimes per capita (y).
and use the generated representations Table 1 (right) shows that KRaM generates representations with minimal information about AAE ratio (high MSE (a)) and low AGDP scores (AGDP ~ 0). These experiments showcase XRaM's efficacy in erasing continuous attributes and minimizing their impact on downstream tasks (low AGDP scores).
Categorical Concept Erasure. In Table 2, evaluate categorical concept erasure DIAL tweet classification (race) and GloVe (gender) datasets. For DIAL dataset, we obtain BERT [34] representations of tweets, perform concept erasure for race (binary) attribute, and use the generated representations fxx) for sentiment classification. We report the accuracy of predicting sentiment (y), race (a), and demographic parity (DP) of the predictions in Table 2 (left). We observe that KRaM performs the best in erasing race attribute (evident from high Acc. (a)) and demographic parity while attaining comparable accuracy on sentiment classification (Acc. (y)). For GloVe embeddings (Table (right)), we observe that KRaM achieves the of-te-of-thh-ar result in suppressing the gender leakage (probing accuracy for predicting binary gender attribute). We observe that linear techniques INLP and RLACE, obtain high alignment scores, Ag, but their representations still contain significant gender information (indicated by high Acc. (a)). This shows a trade-off between information alignment and concept erasure, where robustly erasing a concept may also result in the removal of other information. Categorical concept erasure has been extensively studied, and the fact that a general erasure framework, KRaM, can perform par with state-of-the-art methods underscores its efficacy.
5.2 Analysis
In this section, we perform several analysis experiments understand the functioning of KRaM. Comparison with MI estimation techniques. In this experiment, we compare our concept erasure framework with few state-of-th--arf mutual information (MI) estimation approaches. Essentially,

---

Original
KRaM
Dataset
Acc. (a) 4
Au 7
WS-353 1
GloVe
100.0
1.0
0.70
InfoNCE [43]
64.0
0.55
0.19
MINE [9]
76.8
0.54
0.03
44
CLUB [17]
98.1
0.55
0.06
KNIFE [47]
50.2
0.53
0.10
KRaM
52.6
0.65
0.48
Figure Visualization of UMAP projection of repre- sentations obtained from the synthetic dataset before and after concept erasure. Concept erasure makes the positions of representations uncorrelated with their con- tinuous concept labels (denoted by their color).
Figure 4: Comparison of KRaM with state-of- the-art art mutual information (MI) estimation methods. KRaM achieves balance between good concept erasure nearly with high Ag.
the task of concept erasure can be formalized as maximizing the objective: 7(2,X) - 1(2, A).
where -(.-) denotes the mutual information between two sets. We optimize this objective function with the following MI estimates: InfoNCE [43], MINE [9]. CLUB [17], and KNIFE [47]. In Table 4, we report the gender accuracy (Acc. (a)), As. and performance on WordSim-353 benchmark [2], which is also reflective of the alignment, on Ge dataset. We observe that MI techniques lose significant information from the original representations achieving near-random Ag and WS-353
scores. We believe this happens because MI approaches optimize their estimation parameters along with the erasure function f. which difficult.
We observe a unique scenario for the CLUB method, where the Acc. (a) is high and A is low. This implies that the clusters (related different genders) may be retained but the nearest neighbour structure within the clusters is perturbed significantly. Probing for the downstream task (Acc. (a)) may give you the impression that information from the original space is retained, while A₁ provides more fine-grained view contradicting such an incorrect conclusion. In general, we find that A values are relatively well correlated with WS-353 scores, which is good measure of the information retained in the representation space after erasure. However, computing WS-353 requires additional annotation that may not be feasible for representation sets other than word embeddings.
We also compare KRaM with several other mutual in- formation estimation based baselines that use a unique objective function for controlling information in repre- sentations. Specifically. we compare with MIFR [55], CCL [56]. and ICVAE [42] and report the results on DIAL dataset in Table Note that all of these meth- ods work for categorical concepts only, and ICVAE requires access to concept labels for test instances as well, limitation compared to KRaM and the other methods. In Table 3, we observe MIFR is unable to erase concepts robustly (based on Acc. (a) and DP scores). ICVAE and CCL are able to delete concepts but the significant cost of deleting lot of original information. Loss of information from the original space (low Acc. (g)) using ICVAE and CCL is quite similar to other MI methods reported in Figure 4. Compared to these methods, KRaM is able to get similar concept erasure performance while achieving much higher Acc. (2) scores. We report additional results using these baselines the Glo dataset in Appendix D.
Method
Acc (2) f
Ace (a) |
DP |
Original
75.5
87.7
0.26
MIFR [55]
75.4
68.7
0.21
CCL.156]
50.7
52.6
0.01
ICVAE [42]
66.5
53.3
0.10
KRaM
72.4
54.0
0.08
Table 3: Comparison of KRaM with mu- tual information based baseline approaches DIAL dataset. We observe that KRaM achieves a fine balance between concept era- sure and retaining task performance.
Image-based datasets. We perform experiments on image-based datasets to evaluate the efficacy of KRaM different domains. We consider two different setups using CelebA [37] and Colored MNIST [6] datasets. In CelcbA, we consider the binary variable attractiveness as the target attribute and whether the face has makeup applied (binary variable) as the protected attribute. With concept erasure using KRaM, the accuracy of predicting the makeup attribute dropped from 85.7% to 69.6%. The demographic parity of the predictions (for attractiveness) also improved from 0.94 to 0.54. This shows the effectiveness of KRaM in removing the makeup concept.
For Colored MNIST, we follow the setup of [6] to create a biased version of the MNIST dataset [22]. The background color of the digits made to be well correlated with the digit in the training set. However, no such correlation exists in the test set. We use 0.8 correlation between the background

---

max R(Z(K
max R(Z - R(Z)
max R(Z A|R(Z) - bl
600
500
400
300
200
R(2)
100
R(Z
10f
10
303
107
167
10.
10a
10
10f
10
102
10*
Iterations
Iterations
Iterations
Figure 6: Evolution of 2) and K) under different setups. We monitor the impact on the volume of the overall feature space different settings of the objective function.
color and the digit label. We treat background color as the concept to be erased. Naively training classifier on the images will perform poorly on the test set the classifier can easily overfit the background color. The digit information could be predicted with an accuracy of 79.9%. Post-concept erasure we observe that the classifier's performance improves from 79.9% to 87. %. This shows the effectiveness of KRaM to remove background information and help the classifier generalize better.
Evolution of loss functions. In this experiment, we investigate the evolution of loss terms R( Z) and R(2 () under various settings of the objective function (described in Figure 1) on the synthetic dataset. In Figure 6 (a), we observe that indeed maximizing the kernelized rate-distortion function also leads to an increase in R(2), which can result in the concept variable not being completely erased. In Figure 6 (b), we examine the scenario where It( ()) R( is maximized, where we observe indicate a substantial drop in 2). This reduction often implies low intrinsic dimension and substantial information loss. In Figure 6 (c), we present the evolution of loss terms for KRaM's s objective. We notice that R( ((2 aligns closely with the initial number of bits, denoted as Meanwhile, the R 2 K)) is maximized its full extent (similar to Figure 6 (a)). Through these experiments, provide empirical verification for the insights discussed in relation to Figure
We conduct additional ablation experiments that involve varying hyperparameters and kemnel functions. The results of these experiments are reported in Appendix D.
Conclusion
In this paper, we proposed KRaM, a novel framework to robustly perform concept erasure from representation set. KRaM uses kernelized formulation of the rate-distortion function, where the kernel is created using concept labels. This approach ensures that instances with similar concept labels become dissimilar in the representation space, which ultimately results in the erasure of the concept variable. KRaM is versatile method capable of erasing wide range of concepts, including categorical, continuous, and vector- valued variables. We theoretically analyze several properties of the proposed KRaM objective. Empirical evaluation shows the efficacy of KRaM on wide range of setups ranging from gender erasure from GloVe embeddings to vector-valued concept erasure from GPT-3.5 embeddings. We also propose heuristic-based measure capture the information alignment of the erasure function f by analyzing the k-nearest neighbours of the representations. While KRaM effectively erases concepts, it does result in the loss of some information from the original space, as evidenced by the alignment scores. Determining the minimum amount information that must be distorted to fully erase concept remains open question. Future research could concentrate on gaining a deeper understanding of this issue and developing techniques that can erase concepts from representations while having minimal impact on alignment with original representations.
Acknowledgement
The authors are thankful to Alex Beutel (OpenAl previously Google Research) and Kelsey Allen (Google DeepMind) for helpful feedback on an earlier version of this paper. The work of Somnath Basu Roy Chowdhury and Snigdha Chaturvedi was supported in part by Amazon Research Awards.
References
[1] Jigsaw unintended bias in toxicity classification. 2019.
10

---

[2] Eneko Agirre, Enrique Alfonseca, Keith Hall, Jana Kravalova, Marius Paşca, and Aitor Soroa. study on similarity and relatedness using distributional and WordNet-based approaches. In Proceedings of Human Language Technologies: The 2009 Annual Conference of the North American Chapter of the Association for Computational Linguistics, pages 19-27, Boulder, Colorado, 2009. Association for Computational Linguistics.
[3] Luis M Antunes, Ricardo Grau-Crespo, and Keith T Butler. Distributed representations of atoms and materials for machine learning. npj Computational Materials, 8(1):44, 2022.
[4] Ehsaneddin Asgari and Mohammad RK Mofrad. Continuous distributed representation of biological sequences for deep proteomies and genomics. PloS one, 10<11)ce044227, 2015.
[5] Jimmy Ba, Jamie Ryan Kiros, and Geoffrey E. Hinton. Layer normalization. ArXiv, abs/1607.06450 2016.
[6] Hyojin Bahng, Sanghyuk Chun, Sangdoo Yun, Jaegul Choo, and Seong Joon Oh. Learning de-biased representations with biased representations. In International Conference on Machine Learning, pages 528-539, PMLR, 2020.
[7] Maria Barrett, Yova Kementchedjhieva, Yanai Elazar, Desmond Elliott, and Anders Søgaard. Adversarial removal of demographic attributes revisited. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Con- ference Natural Language Processing (EMNLP-IJCNEL pages 6330-6335, Hong Kong, China, November 2019, Association for Computational Linguistics.
[8] Somnath Basu Roy Chowdhury, Sayan Ghosh, Yiyuan Li, Junier Oliva, Shashank Srivastava, and Snigdha Chaturvedi. Adversarial scrubbing of demographic information for text classification. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 550-562, Online and Punta Cana, Dominican Republic, November 2021. Association for Computational Linguistics.
[9] Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeshwar, Sherjil Ozair, Yoshua Bengio, Aaron Courville, and Devon Hjelm. Mutual information neural estimation. In International conference machine learning, pages 531-540. PMLR, 2018
[10] Jon Louis Bentley. Multidimensional binary search trees used for associative searching. Com- munications of the ACM, 18(9):509-517, 1975.
[11] Lukas Biewald. Experiment tracking with weights and biases, 2020. Software available from wandb.com.
[12] Su Lin Blodgett, Lisa Green, and Brendan O'Connor. Demographic dialectal variation in social media: A case study of African- American English. In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing, pages 1119-1130, Austin, Texas, 2016. Association for Computational Linguistics.
[13] Tolga Bolukbasi, Kai-Wei Chang, James Y Zou, Venkatesh Saligrama, and Adam T Kalai. Man is to computer programmer as woman is to homemaker? debiasing word embeddings. Advances in neural information processing systems, 29, 2016.
[14] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 13:77-111 2020.
[15] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models few-shot learners. Advances in neural information processing systems, 33: 13:777119 2020.
[16] Yang Trista Cao, Yada Pruksachatkun, Kai-Wei Chang, Rahul Gupta, Varun Kumar, Jwala Dhamala, and Aram Galstyan. On the intrinsic and extrinsic fairness evaluation metrics for contextualized language representations. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 561-570, Dublin, Ireland, May 2022, Association for Computational Linguistics.

---

[17] Pengyu Cheng, Weituo Hao, Shuyang Dai, Jiachang Liu, Zhe Gan, and Lawrence Carin. Club: contrastive log-ratio upper bound of mutual information. In International conference on machine learning, pages 1779-1788. PMLR, 2020.
[18] Somnath Basu Roy Chowdhury and Snigdha Chaturvedi. Learning fair representations via rate-distortion maximization. Transactions of the Association for Compulational Linguistics, 10:1 1194, 2022.
[19] Somnath Basu Roy Chowdhury and Snigdha Chaturvedi. Sustaining fairness via incremental learning. In AAAI Conference on Artificial Intelligence, 2023.
[20] Thomas M Cover. Elements of information theory. John Wiley & Sons, 1999.
[21] Trevor Darrell and Alex Pentland, Classifying hand gestures with a view-based dis- tributed representation. J. Cowan, G. Tesauro, and J. Alspector, editors, Advances in Neural Information Processing Systems, volume 6. Morgan-Kann Kaufmann, 1993.
[22] Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141-14) 2012.
[23] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, al. An image is worth 16x16 words: Transformers for image recognition at scale. Internation Conference on Learning Representations, 2021.
[24] Jingfei Du, Myle Ott. Haoran Li, Xing Zhou, and Veselin Stoyanov. General purpose text embeddings from pre-trained language models for scalable inference. In Findings of the Association for Computational Linguisties: EMNLP 2020, pages 3018-300 1188-000, Online, November 2020. Association for Computational Linguistics.
[25] Yanai Elazar and Yoav Goldberg. Adversarial removal of demographic attributes from text data. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 11-21, 2018
[26] Yanai Elazar, Shauli Ravfogel, Alon Jacovi, and Yoav Goldberg, Amnesic probing: Behavioral explanation with amnesic counterfactuals. Transactions of the Association for Computational Linguistics, 9:160-175. 2021.
[27] Shuyang Gao, Greg Ver Steeg, and Aram Galstyan. Efficient estimation of mutual information for strongly dependent variables. In Artificial intelligence and statistics, pages 277-286. PMLR, 2015.
[28] Irina Higgins, Le Chang, Victoria Langston, Demis Hassabis, Christopher Summerfield, Doris Tsao, and Matthew Botvinick. Unsupervised deep learning identifies semantic disentanglement in single inferotemporal face patch neurons. Nature communications, 12(1))6456, 2021.
[29] Irina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick. Shakir Mohamed, and Alexander Lerchner. beta-vae: Learning basic visual concepts with constrained variational framework. In International conference on learning representations, 2017.
[30] Geoffrey E Hinton. Distributed representations. 1984.
[31] Geoffrey E. Hinton. Learning distributed representations of concepts. 1989.
[32] Ayush Jaiswal, Daniel Moyer, Greg Ver Steeg, Wael AbdAlmageed, and Premkumar Natarajan. Invariant representations through adversarial forgetting. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 4272-4279, 2020.
[33] Zhimeng Jiang, Xiaotian Han, Chao Fan, Fan Yang, Ali Mostafavi, and Xia Hu. Generalized demographic parity for group fairness. International Conference on Learning Representations, 2021.
12

---

[34] Jacob Devlin Ming- Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of NAACL-HLI, pages 4171-4186, 2019.
[35] Alexander Kraskov, Harald Stögbauer, and Peter Grassberger. Estimating mutual information. Physical review E, 69(6):066138, 2004.
[36] M Lichman. Uci machine learning repository: Communities and crime data set, 2013.
[37] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference Computer Vision (ICCV), December 2015.
[38] Yi Ma, Harm Derksen, Wei Hong, and John Wright. Segmentation of multivariate mixed data via lossy data coding and compression. IEEE transactions on pattern analysis and machine intelligence, 29(9): 1566-1562, 2007.
[39] Tomas Mikolov, llya Sutskever, Kai Chen, Greg S Corrado, and Jeff Dean, Distributed repre- sentations of words and phrases and their compositionality. Advances in neural information processing systems, 26, 2013.
[40] Bhaskar Mitra, Fernando Diaz, and Nick Craswell. Learning to match using local and distributed representations of text for web search. In Proceedings of the 26th International Conference on World Wide Web, WWW '17, page 1291-1299, Republic and Canton of Geneva, CHE, 2017. International World Wide Web Conferences Steering Committee.
[41] Young-II II Moon, Balaji Rajagopalan, and Upmanu Lall. Estimation of mutual information using kernel density estimators. Physical Review E, 52(3):2318, 1995.
[42] Daniel Moyer, Shuyang Gao, Rob Brekelmans, Aram Galstyan, and Greg Ver Steeg. Invariant representations without adversarial training. Advances in Neural Information Processing Systems, 31, 2018.
[43] Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprint 1r0ivv1807.03740 2018
[44] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary Vito,, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high- performance deep learning library. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché- Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 32, pages 8024-8035. Curran Associates, Inc., 2019.
[45] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, Prettenhofer. R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2883 2830. 2011.
[46] Jeffrey Pennington, Richard Socher, and Christopher D. Manning. Glove: Global vectors for word representation. In Conference on Empirical Methods in Natural Language Processing, 2014.
[47] Georg Pichler, Pierre Jean A Colombo, Malik Boudiaf, Günther Koliander, and Pablo Piantanida. A differential entropy estimator for training neural networks. In International Conference on Machine Learning, pages 17691-17715. PMLR, 2022.
[48] Juan-Pablo Posadas-Durán, Helena Gómezz-Aorno Grigori Sidorov, Ildar Batyrshin, David Pinto, and Liliana Chanona--Heránder Application of the distributed document representation in the authorship attribution task for small corpora. Soft Computing, 21 21:627-639, 2017.
[49] Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg. Null it out: Guarding protected attributes by iterative nullspace projection. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 7237-7256, Online, July 2020. Association for Computational Linguistics.
13

---

[50] Shauli Ravfogel, Michael Twiton, Yoav Goldberg, and Ryan D Cotterell. Linear adversarial concept erasure. In International Conference on Machine Learning, pages 18400-18421. PMLR, 2022.
[51] Shauli Ravfogel, Francisco Vargas, Yoav Goldberg, and Ryan Cotterell. Adversarial concept erasure in kernel space. Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 6034-6055, 2022.
[52] Shauli Ravfogel, Francisco Vargas, Yoav Goldberg, and Ryan Cotterell. Kernelized concept erasure, In EMNLP 2022. arXiv, 2022.
[53] James R Schott. Matrix analysis for statistics. John Wiley & Sons, 2016.
[54] Jssai Schur. Bemerkungen zur theorie der beschränkten bilinearformen mit unendlich vielen veränderlichen. 1911.
[55] Jiaming Song, Pratyusha Kalluri, Aditya Grover, Shengjia Zhao, and Stefano Ermon. Learning controllable fair representations. In The 22nd International Conference Artificial Intelligence and Statistics, pages 2164-2173. PMLR, 2019.
[56] Yao-Hung Hubert Tsai, Martin Q Ma, Han Zhao, Kun Zhang, Louis-Phillppe Morency, and Ruslan Salakhutdinov. Conditional contrastive learning: Removing undesirable information in self-supervised representations. arXiv e-prints, pages arXiv-2106, 2021.
[57] Laura Wendlandt, Jonathan K. Kummerfeld, and Rada Mihalcea. Factors influencing the surprising instability of word embeddings. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Volume (Long Papers), pages 2092 2102, New Orleans, Louisiana, June 2018. Association for Computational Linguistics.
[58] Aolin Xu and Maxim Raginsky. Information-theorrticc analysis of generalization capability of learning algorithms. In NIPS, 2017.
(59) Yaodong Yu, Kwan Ho Ryan Chan, Chong You, Chaobing Song, and Yi Ma. Learning diverse and discriminative representations via the principle of maximal coding rate reduction. Advances in Neural Information Processing Systems, 33:9422-9493 2234,, 2020.
[60] Rich Zemel, Yu Wu, Kevin Swersky, Toni Pitassi, and Cynthia Dwork. Learning fair representa- tions, In International conference on machine learning, pages 325-333, PMLR, 2013.
14

---

A Theoretical Proofs
A.1 Proof of Lemma
We prove the general bounds for R(Z(K) by independently proving the lower and upper bound using the following intermediate results.
Lemma 3 (Lower bound for R R))) For any 2 E R kernel matrix K E TR using kernel function satisfying k(x,z) x) = and c > 0, it holds that:
R(2(K) 2 R(2),
where the equality is satisfied only when K 11
Proof. We start off by writing down the expanded form of R( K) as:
1 K( 2 logz det [+
d
zz o o
(8)
ne²
In the above equation 8, we first note that both zg" and K matrices are positive-semi definite symmetric matrices. Using Schur product theorem [54], we can show that their hadamard product 2z C K is also positive semi-definite (for d 1). Next, we utilize the following property for Hadamard products:
Theorem 7.25 [53]. Given two positive semi-definite square matrices A and B of dimension m. Then,
the following property holds: det(A @ B) 2 det(AA II
by
==1
Applying this property to 22 @ K, we get the following result:
det de @ K) 2 det(Zzz),
(9)
where K,; = 1, Vi. Now, since T @ and 0 are positive semi-definite, their corresponding
eigenvalues are non-negative, AZzz O K) 0 and (zZz)) 0. Since the eigenvalues
non-negative, we can extend Equation 4 as follows:
aI о оK)
2 II (22
II 1+ ne
M ok))
2 II
1
(ZZT)
ne?
(10)
i
det [+ ne²
④ K
2 det I+ ne?
1ZT
R(Z(K) 2 R(2),
where the second inequality holds because the affine transform of positive variables preserves incqualities. The equality is satisfied when K = 11T
Lemma 4 (Upper bound for R(Z(K)), For any Z E RRadd any kernel matrix K E Ruxn using kernel function satisfying k( x)) and > 0, it holds that:
2 2
logz (1 + d/ne?)
(11)
Proof. We start by noting that the Hadamard product two positive semi-definite matrices Z2T O K RR is positive semi-definite (using the Schur product theorem). We also assume that the representations E Z are unit normalized, thereby the diagonal entries of (Zz")) ) 1. The
diagonal entries K,; which implies (Zz" K) = 1. Given these facts, can write the
following properties of about the eigenvalues of ZZ" O K:
(ZZ о K) 1 0, Σ A2ZZZ O K) = n,
(12)
15

---

where the second property follows from the fact that tr tr(ZZ" the maximum value of R K) that can be written as:
: K) = n. We are interested in finding
II
(+ ==1 ne
(Zz о OK)
R K)
loga
(13)
2
To maximize R(Z(K) we need to maximize the product within the logarithm. Each temn within the product 1 1+ n²² the product is maximized when all the individual terms are equal,
d (Z @ K) > 0 (eigenvalues of a PSD matrix). Using the AM-GM inequality,
A(Zzz C K) n/n = 1.
(14)
Substituting this result in Equation 13, obtain the following upper bound:
K{ S 2
logg( (1 + d/ne²),
(15)
where the equality achieved when Zgt when all the representations are orthogonal. Note that this is only possible when d 2 n.
Proof of Lemma 1. By combining the results of Lemma 3 & 4, we get the following:
R(Z) R(Z[K) < log, (1 + d/nee).
(16)
This completes the proof.
A.2 Proof of Lemma
Lemma 2 (Alignment for random representations). Expected A&()) score achieved by concept erasure framework that generates random representations is ([)) k/n.
Proof. To prove this, we first assume two randomly generated k-nearest neighbour graphs (since the original representation is uncorrelated with the randomly generated one we can consider it as random). As it is a ANN graph, for each node has an expected degree [[d]] RS k, where d is the degree of the node. Now, let's consider the probability of a node z, being part of node zy:
p(r; E knn()z)) de
(17)
E Edd
Elp(2; E knn(x,)))
72
where d; is the degree of node and is the total number of representations. Since computing the exact probability requires knowledge of the degree of the node, we compute the expectation of the same. Next, we compute the probability that node is present in both kNN sets (before and after debiasing) of node j:
[[]nn(æ) knn(2)] E
Eple, p(æ; knn(z,) 2 kmn(z)))
M IE pp(a, e knn(z;))p(zz E knn(z;))) (zz))]
(18)
Σ E [p(x, knn(,,)) [) Ep(2 e knn (2,))
Σ 12t /22n" = kk/nn
where the first step utilizes linearity of expectation, and the second step follows from the fact that the degree distribution of X' and 2 are independent. Replacing the result from Eqn 18 in Eqn we get [f] k/n.
16

---

A.3 Additional Theoretical Results
Lemma 3 (Upper Bound of R(Z K) for categorical concepts). For categorical concept variables with the kernel values K,y E {0. 1}, R(2]K) is bounded by the sum of vate-distortion functions of representation set from individual classes Zj
R(2[K) Σ log, det (T+
d ne² 2,27
7/ Σ ==1
R(2,),
(19)
where the equality holds only when 2,2g- 0, Vj and is the number of classes.
Proof. For categorical variables, the kernel function takes the following form:
11, if a, = aj A(i.5) {0. If the kernel function k(t-)) is of the above form. Using the corresponding kernel matrix K get,
(20)
if a, + aj
2 2 2T 0
d
d ne²
Zg 22
0
M I
22 OK ne²
OK=I- 1+
(21)
2 2
where M becomes a block diagonal matrix and Zi's are representations belonging to class i. Using the determinant property block diagonal matrices, we have:
log, (M)
Σ
loga det
T+ ne2 2,23
J=1
(22)
(I+ nE² 2 2,
R
Σ
loga det
The individual terms in the above summation are closely related the rate-distortion function of representation belonging to each class, j, shown below:
R(2,) loga det [++ (T+ d
nye² 2
(23)
where n, is the number of representations in class j. Note, ny < n, where the total number of representations. Using the property that multiplying a matrix with scalar is equivalent multiplying its eigenvalues with the same scale, and that Z is PSD matrix. We can show:
2 logg det (I+ niz 2,
1
R(ZIK)=
<
j=1
(24)
K
R(2,).
This completes the proof.
Discussion. Notice that this is closely related to the MCR objective, which tries to learn discrimina- tive subspaces for individual classes. For concept erasure, we aim for the opposite effect by making instances from the same class dissimilar by maximizing their rate-distortion function.
17

---

Algorithm 1 Correlation Computation Routine
Input: Input representation set X' [
2: y = (gn W2)
> generate labels using random weights W2 E Raxm Wi E Raxi
3: U, V s2'
4: Zn = X'
Initializing the representations accuracy and alignment sets
5: A ssoccss = 0
6: for i E (l.....d) dt do
(i)
7:
u [V]l
D access the i-th column of V null space projection matrix
8:
P. = u un?
9:
2, P;
A AU acc 2 y)
compute accuracy > compute alignment scores
11:
scores = scores U A PI)
12: end for
13: Pearson A, scores)
> compute the Pearson correlation
14: return
B Alignment Scoring
In this section, we present several measures to capture information alignment and compare them with our proposed metric (in Section 4).
KSG MI estimator [35]. The PaaskovSStobbuuer Stogbaaer-Grrassbbrrereer (KSG) estimator uses the nearest neighbour information in the joint and marginal space to obtain mutual information estimate. Specifically, computes the number neighbours around point within a hypercube in the marginal spaces. The length of the hypercube is set based on the max-norm distance to the k-th neighbour in the joint space. The KSG MI estimate between two sets X' and 2 can be shown as follows:
[X,
(bk) - 1/k E(z((n=) (n=))] + (NN),
(25)
where (-) is the digamma function, ng and n, are the number points in the hypercube of the respective marginal spaces. In our experiment, we use the KSG MI estimator evaluate the alignment between representation sets before and after concept erasure.
Degree distribution. In k-nearest neighbour graph, some nodes are more connected to others (hub nodes) while others are sparsely connected. Building on our intuition of alignment A₁ using the nearest neighbour graphs of representations, D(X), during concept erasure to gauge how the underlying structure of the representation set has changed. We quantify the change using either L1-norm, 1.2-norm, or KI.-divergence between the normalized degree distributions D(Y) and DZZ).
can consider changes in its degree distribution,
Experiments. We perform experiments in a controlled setup to evaluate the efficacy of the proposed alignment measures.
(a) Simulated Erasure. this experiment, we simulate knowledge erasure from a set of synthetic representations and observe how the alignment scores correlate with the downstream accuracy. Algorithm 1 shows the details for this process. First, we sample set of representations from a uniform distribution X' Raxd from uniform distribution and construct label set Y (using randomly sampled weights Wi, W2). In a way, the label set retains some information about the original representations that will probe as erasure happens. Then, gradually remove information from representations Z by projecting them onto the nullspace P formed using the eigenvectors After each iteration of projection, we compute the accuracy of predicting y and alignment score, Ag- We report the Pearson correlation between the accuracies and information alignment in Table 4 (left side), along with the hyperparameter used for each measure. We observe that A outperforms other approaches achieving better correlation, which showcases the efficacy of our approach.
(a) Correlated Gaussians. In this experiment, sample sets of Gaussians (zero mean) with fixed covariance a. In this setup, the mutual information has a closed-form solution:
I(X', 2) = =- log(1 - -²).
(26)
We use the samples to compute the different alignment measures and investigate they'r re correlated with the actual mutual information (Equation 26). Note that there does not exist explicit mapping
18

---

Simulated Erasure
Correlated Gaussian
Metric
k/n (%)
Pearson (r)
k/n (%)
Pearson (r) f
KSG
0.965
0.02
0.989
KL-div (degree)
0.1
0,874
0.2
0,490
1.2-norm (degree)
0.1
0.865
0.2
0.458
L1-norm (degree)
0.1
0,905
0.2
0.564
Alignment: Aş
0.994
0.969
Table Comparison of A& with other alignment measures on synthetic datasets. We observe that Aş achieves the best Pearson correlation scores with downstream accuracy on simulated concept crasure experiments due the presence of mapping function f. In a separate experiment, the KSG estimator shows the highest correlation with MI. Aş also achieves high correlation score, while the degree distribution baased measures perform poorly due the lack of mapping function.
between these samples. In Table (right side), we report the Pearson correlation scores for different measures. We find that the KSG MI estimator outperforms others, with Aş coming in as a close second. This is because our alignment scores assume I-to-1 mapping between the sets, which is absent in this case. The degree-distreg siggre-ddstribution-bae -asidd scores suffer even more as their measure is even more strongly reliant on the mapping. These results show that the alignment score Aş leverages the bijective mapping generate scores that are well correlated with the mutual information but can be inaccurate cases where the mapping function absent.
19

---

C Implementation details
In this section, we provide various implementation details about our experimental setup. Specifically, we describe the details of the dataset, metrics, and hyperparameters utilized.
C.1 Dataset
In this section, we describe the details of the datasets that were used in the experimental section.
GloVe embeddings [46]. We revisit the problem of deleting gender information (binary attribute) from word embeddings [13]. Specifically, we consider the GloVe embeddings of the 150k most frequently occurring words. For training KRaM, we follow the setup of [49, 18] to select the 7500 most male-biased, female-biased, and neutral words determined by the magnitude of the word vector's projection onto the gender direction (the largest principal component of the space of vectors formed using the difference gendered word vector pairs).
DIAL [12] is a Twitter- based sentiment classification dataset, where each tweet is associated with sentiment labels and "race" information (binary concept label) of the author. The sentiment concept labels are "happy" or "sad" and the binary race concept labels are "African-Amerian" English" (AAE) or "Standard American English" (SAE).
Synthetic dataset. We create a dataset where the representations are generated using a continuous latent variable, a, which serves as our concept label. During data generation, we first sample the latent variable a ~ Uni(O, 1), and then sample the high-dimensional representation x ~ Vaaaa ala), where 1a vector of ones and Ia the identity matrix. For this dataset, we set the dimension of the representations to be d = 100. In this setup, we observe that the latent concept label, a, is being used scale the underlying isotropic Gaussian distribution. Therefore, post-concept erasure the representation space should appear like an isotropic Gaussian distribution, which is indeed the case as shown in Figure 5.
UCI Crimes [36]. This dataset' contains information about US communities 1990 from various surveys. The dataset provides 128 attributes (both categorical and continuous variables) from 1,994 different US communities. we concatenate individual attributes of a community to obtain its representation. The regression task involves predicting the number of violent crimes per capita. We consider the ratio of African-Amerrcan (AAE) people (continuous attribute) in a community as the concept be erased.
Jigsaw Toxicity Classification [1]. This dataset contains online comments and the binary classi- fication task involves detecting whether comment is toxic not. In this dataset, consider two different concepts: religion and race. We consider a vector-valued protected attribute for this dataset. For the religion concept, consider unnormalized vector over the following categories: ('buddhist', 'christian', 'hindu', 'jewish', 'muslim', 'other_religine }. Similarly, for the gender consider the following categories: ('bisexual', 'female', "heterosexual", "homosexual, gay, or lesbian', 'male', 'other gender', 'other sexual orientation' 'transgender' }. During concept erasure of either concept, we only consider instances where at least one of the concept categories has non-zero value and reserved 20% of the instances as the test set. This resulted in a dataset with a train/test split of (72k, 18k) for the religion concept and (106k, 26k) for the gender concept. We retrieve text representations for the comments from GPT-3.5 [15] and perform concept erasure on them.
C.2 Metrics
In this section, we present the details of the fairness metrics used in our experiments. Demographic Parity (DP). Demographic Parity measures the difference in the probability of prediction w.r.t to the protected attribute A. Formally, is defined as:
DP
Σ p(ū y|A a) plū v/A = ر)}
(27)
NEY
where a, ā are possible values of the binary concept and y is the set of possible target attribute labels.
20

---

Generalized Demographie Parity (AGDP). Most of the literature on fairness metrics has focused on categorical variables. We use Generalized Demographic Parity (GDP) [33], which measures the discrepancy in outcome with respect to continuous variable. GDP measure extends Demographic Parity for continuous protected attributes. It defined as follows:
AGDP = [.' [m(a) mavgl P(A aida,
(28)
where m(a) = A - a] is expected prediction of the model when protected attribute A = Mavg E is overall expected prediction, and P(A a) the probability that the protected attribute takes value a. The probability density P(-) can be measured using a histogram or kernel method. We used kernel function evaluate the probability density.
C.3 Hyperparameters
In our experiments, we primarily deal with two hyperparameters: regularization constant, À (in Equa- tion 4), and associated with the standard deviation of a Gaussian kernel (k(r, y) - We set these parameters by performing grid search on the development set using Weights Bi- ases [].]. We use a multi-layer neural network with ReLU non-linearity as the crasure function f. We further perform ablation experiments to understand the impact of these parameters on concept erasure performance (shown in Figure 8). All networks were trained using single 22GB NVIDIA Quadro RTX 6000 GPU and experiments were executed in Py PyTorch [44] framework.
21

---

D Additional Results
In this section, we present additional experiments to analyze KRaM's concept erasure performance.
Vector-valued Concept Erasure. In this section, we present the results of vector-valued gender concept removal from GPT-3.5 text embeddings from the Jigsaw Toxicity classification dataset. We report the MSE and AGDP results in Figure 7. We observe that KRaM is able to significantly increase the gender MSE while simultaneously reducing the AGDP scores. During the debiasing process, we observe that there is minimal impact on the toxicity classification accuracy (91.9% + 90.1%% 1%).
Original
BLACEa
INLPo
KRaM
Original
RLACE,
IMLPa
KRah
MSE better)
10-1
AGDP [4 better)
0.015
6.013
0.010
10-2
00.077
0.035
10-2
Bisesual Fermaaee Helero-
Home-
Male
Dther
Other
Trans- gander
0.000
Disec.u
Faetade
Flomo-
Male
Dther
Sosua
soxuel
genider
Figure 7: Vector-valued concept erasure performance using KRaM on Jigsaw toxicity classification dataset (gender concept). We observe a significant reduction in AGDP scores post erasure of vector- valued gender concept with negligible impact toxicity classification performance.
Ablation with different kernels. We perform abla- tion experiments with different kernel functions used to define the K and observe its impact on the concept erasure performance. In Table 5, we report the results for erasing the continuous concept on the synthetic dataset. Apart from the kernel function, we use the same hyperparameters in all setups. We observe that KRaM achieves similar concept erasure performance using different kernel functions. We observe that us- ing the Gaussian kernel function in KRaM yields the best crasure performance and aligmment score Ag improves when we linear erasure function f-
Method
MSE (a) f
A f
Original
0.006
1.0
KRaM (Laplace)
0.083
0.68
KRaM (Cauchy)
0.092
0.63
KRaMinnorr (Gaussian)
0.083
0.75
KRaM (Gaussian)
0.109
0.67
Table 5: Ablations with kernel functions: we observe that KRaM achieves similar perfor- mance using different kernel functions.
Controlled experiments. order to better understand concept erasure performance, we evaluate KRaM on axis- data in controlled setup. We generate a synthetic two-dimensional dataset involving two Gaussians centered at (0, 2) and (0, -2) respectively. and identity covariance. We consider the y-axis as the continuous concept to be deleted. The desired outcome of deleting an axis-aligned concept in two-dimensional data that points should lie on ID line and the KRaM output should be least correlated with the axis concept that deleted. That is reduction in dimension such that most of the data variation should be constrained along a single dimension for this case. We looked at the eigenvalues of both the original data and the concept deleted (by KRaM) output. The fraction of eigenvalue masses in the original data (65%, 35%) and in the KRaM concept deleted output the fraction of masses is 999%, 0.002%) This shows that KRaM is able to effectively delete the target concept resulting in a drop in intrinsic data dimension.
Comparison with MI baselines. We present the results on mutual information (MI) estimation-based baselines on the GloVe dataset. Consistent with the results in Table 3, we observe that other MI estimation baselines are either unable to erase concepts robustly (MIFR) or end up erasing sig- nificant amount of information along with the concept (CCL and ICVAE) in Table 6. In contrast to these approaches, we observe that our rate-distortion based framework, KRaM, is able to achieve good balance between concept erasure and retaining original information (indicated by A²).
Method
Acc (a) +
A 1
Original
100.0
1.0
MIFR [55]
68.3
0.58
CCL [56]
56.9
0.56
ICVAE [42]
51.5
0.50
KRaM
52.6
0.65
Table 6: Comparison of KRaM with MI- based baselines on GloVe dataset. We observe that KRaM achieves good bal- ance between concept erasure and re- taining original information.
Ablation of parameters. In this experiment, we perform ablations with several parameters in KRaM and observe how that affects the concept crasure performance. First, we ex-
22

---

Ax Gender ACC.
4
0.15
Gender
0.1
MSE (8)
0.10
0.60
0.6
0.55
0.00
10"4
10
10F
10:
10"
10
10
10"1
10"
10-1
10"L
A
0
Figure 8: Ablation experiments to study the effect of parameters À (Eqn. 4), (a scaling factor in R(Z) = rb), and a (parameter in gaussian kernels) on the performance concept deletion.
periment with gender removal from GloVe embeddings to understand the impact of (Eqn. 4). In Figure 8 (left), we observe that as À increases, concept erasure worsens (f gender accuracy). This is expected as the erasure function f is penalized for | 2) bj term more than maximizing R [ K) (which helps in erasure). The alignment scores A₁ stay mostly stable with minor drop at high values. We believe this happens the underlying representation structure. Second, in the same setup, we modify the equality constraint to be: 2)) rb| and ablate r (shown in Figure (center)). We observe that both alignment scores and gender accuracy increase with increase in т, which demonstrates the importance of this constraint. Even though [(Z) ()) is maximized, the overall feature space expands (high r), the concept variable can still become distinguishable (high gender accuracy). Third, in Figure 8 (right), we report the MSE scores on the synthetic dataset for varying a (the parameter in the Gaussian kernel). In all setups within Figure 8 (right), notice the same pattern of increasing MSE (a) scores followed by a decrease. We believe this drop happens with higher a values because distances become very small and kernel values are similar. This results in the kernel ignoring the similarity of instances in the concept space.
aims match the rate-distortion constant, possibly neglecting
E Broader Impact & Limitations
In this section, we discuss the broader societal impact and limitations of our framework, KRaM.
Limitations. While crasing sensitive concept attributes can reduce bias and improve privacy, it may also result in the loss of potentially useful information for the task at hand. This could negatively impact the utility of the model. The definition of what constitutes sensitive concept attribute can vary greatly depending sensitive attributes can be clearly defined and agreed upon, which might not always be the case. Therefore, developers using such erasure frameworks should take care of the societal impact before utilizing them in the wild.
the cultural, ethical, and legal context. This work assumes that these
Negative Usage KRaM intended to be used in scenarios where the user is already aware of the concept attribute to be crased. KRaM can only be trained on data where concept labels are annotated either as categorical, continuous, vector valued attributes. One potential misuse of KRaM would be to define relevant features for task (e.g., experience for a job application) as a concept to be erased. In such cases, the classification system may be forced to rely sensitive demographic information for predictions. It is possible to flag systems in these cases by evaluating the statistical parity when the concept attributes have changed.
In general, we hope that our proposed concept erasure framework, KRaM, would encourage others to develop more robust concept erasure systems that can simultaneously retain lot of information from the original representations.
23


Reviews:
[{"review_id": "CtfMWqYCVp", "reviewer": "Reviewer_yWDJ", "summary": "This paper studies concept erasure, a task proposed by prior work [1,2] which aims to remove information from a chosen attribute while retaining other information from the original input as much as possible. This paper achieves this by maximizing the kernelized rate-distortion maximizer (KRaM), an objective from information theory measuring how well lossy compression methods obtain the original information—specifically, maximizing the objective results in increased dissimilarity between instance pairs with similar concept labels, leading to the distances in the learned representation unrelated to the concept labels, achieving concept erasure. To preserve the information from the original input, a constraint is proposed in this paper by maintaining the rate-distortion function to a constant size using a Lagrangian function. The authors propose to use k-nearest neighbors to measure the alignment: how much the learned representation preserves the information from the original input after concept erasure. Bounds for the objective and expectation of the alignment are provided. Finally, the authors provide empirical results to demonstrate that the proposed method can erase concepts (categorical, continuous, and vector-valued) in the DIAL, UCI Crimes, and Jigsaw toxicity datasets.\n\n\n[1] Ravfogel, Shauli, et al. \"Kernelized Concept Erasure.\" arXiv preprint arXiv:2201.12191 (2022).\n\n[2] Ravfogel, Shauli, et al. \"Linear adversarial concept erasure.\" International Conference on Machine Learning. PMLR, 2022.\n", "questions": "In Figure 4, the accuracy and alignment score trend differs from Section 4, where the authors claim that the alignment score is well correlated with the downstream performance. The reviewer is unsure about this and gently asks the authors to clarify.", "limitations": "The authors have discussed the limitations of the work as well as future directions.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "Originality: The research problem is already defined and studied, but the method of using kernelized rate-distortion function for concept erasure is new.\n\nQuality: The quality of this submission is relatively high. The related publications are cited and discussed. The empirical analysis is comprehensive, and the theoretical results are also provided. Notably, the method can erase concepts from categorical attributes and continuous or vector-based concepts (e.g., word vectors). A synthetic experiment verifies the proposed measuring alignment and outperforms other alignment measurements. The empirical results on vector-valued concept erasure are convincing.\n\nClarity: The paper is well-written. Key terms, such as concepts, the rate-distortion function, and the alignment score measurement, are clearly defined.\n\nSignificance: The authors make a great effort to use the proposed KraM on distributed word vector representations such as GPT-3.5 to erase concepts, making this work very relevant and significant to the recent trends of large language models and valuable for many real-world tasks requiring removing certain concepts or attributes.\n", "weaknesses": "> Instead, objectives for concept erasure use no supervision (apart from the labels of the concept to remove). This makes using adversarial learning or mutual information estimation methods for concept erasure difficult.  \n\nUnfortunately, this may not be the case. Although the specific problem of concept erasure is not studied in mutual information estimation methods, works such as [1-3] remove information from a particular attribute without any downstream task known using mutual information estimation or invariant learning. It would be helpful for the reviewer to give final recommendations if the authors could further compare these works.\n\nAlso, the proposed method has similar or worse results than baselines, such as some entries in Table 1.\n\n[3] Song, Jiaming, et al. \"Learning controllable fair representations.\" The 22nd International Conference on Artificial Intelligence and Statistics. PMLR, 2019.\n\n[4] Tsai, Yao-Hung Hubert, et al. \"Conditional contrastive learning: Removing undesirable information in self-supervised representations.\" arXiv e-prints (2021): arXiv-2106.\n\n[5] Moyer, Daniel, et al. \"Invariant representations without adversarial training.\" Advances in Neural Information Processing Systems 31 (2018).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed review. Please find our responses below:\n\nWeaknesses:\n\n(W1) Thank you for pointing out these works. We will remove the specific claim and cite these works. We have compared with the suggested works and the results on categorical concept erasure are reported below:\n\n*DIAL Dataset Results*\n\n|Method| Acc. (y) $\\uparrow$      | Acc. (a) $\\downarrow$      |  DP $\\downarrow$ |$A_k$ $\\uparrow$ |\n| :---        |    :----:   |:----:   |:----:   |:----:   |\n|Original (w/o concept erasure) |75.5 |87.7 |0.26| 1.0\n|MIFR (Song et al. 2019, [3])|75.4|68.7|0.21|0.88|\n|CCL (Tsai et al. 2019, [4])|50.7|52.6|0.01|0.60|\n|ICVAE (Moyer et al. 2018, [5])|66.5|53.3|0.10|0.55|\n|KRaM (Ours)|72.4 |54.0 | 0.08| 0.74|\n\n*GloVe Results*\n\n|Method| Acc. (a) $\\downarrow$ |$A_k$ $\\uparrow$ |\n| :---        |    :----:   |:----:   | \n|Original (w/o concept erasure) |100 |1.0 |\n|MIFR (Song et al. 2019, [3])|68.3|0.58|\n|CCL (Tsai et al. 2021, [4])|56.9|0.56|\n|ICVAE (Moyer et al. 2018, [5])|51.5|0.50|\n|KRaM (Ours)|52.6 |0.65 | \n\nNote the following limitations of these methods:\n* ICVAE requires access to concept labels for test instances as well, a limitation compared to KRaM and the other methods listed.\n* Moreover, CCL, ICVAE, MIFR can function only for categorical attributes. \n\nHere are our conclusions from the above results:\n* MIFR is unable to erase concepts robustly (see Acc. (a) and DP scores). \n* ICVAE & CCL is able to delete concepts but at the significant cost of deleting a lot of original information. \n* Loss of information from the original space (low $A_k$) using ICVAE and CCL is quite similar to other MI methods reported in Figure 4 of our paper (about ~0.9-0.29 points behind KRaM in $A_k$). \n*  KRaM is able to get similar concept erasure performance while achieving much higher $A_k$ and Acc. ($y$) scores in both setups. \n\nQuestions:\n\n(Q1) Thanks for the great question. \n\nThe experiment was conducted on the GloVe dataset where male and female-biased words form distinct clusters. \n\nWe observe a unique scenario for the CLUB method. The gender prediction accuracy is high and the $A_k$ is low. This implies that the clusters (related to different genders) may be retained but the nearest neighbour structure within the clusters is perturbed significantly. \n\nProbing for the downstream task (gender accuracy) may give you the impression that information from the original space is retained, while $A_k$ provides a more fine grained view contradicting such incorrect conclusion.\n\nWe find that $A_k$ values are relatively well correlated with the WS-353 scores.\nWS-353 is a good measure of the information retained in the representation space after erasure . Computing the WS-353 however requires additional annotation that may not be feasible for representation sets other than word embedding. "}, {"review_id": "6R4JL8tDv5", "reviewer": "Reviewer_GgzL", "summary": "The paper proposes a novel method to erase concepts from a distributed/latent data representation. The method is based on a kernelized rate-distortion function that can be maximized to achieve concept erasure. The kernel encodes the \"concept similarity\" between two samples, and it is therefore supervised. That is, it needs a concept label associated with the samples.\n\nFrom a set of experiments, the authors show that in general they manage to achieve a more effective concept erasure without loss of performance in downstream tasks.", "questions": "- Gaussianity assumption: have the authors tested with different formulations of the rate distortion function? would this be feasible?\n- Determinant scalability: the determinant seems to badly scale with the number of samples in Z. Could the authors comment on the computational bottleneck of their method, and possible ways to solve it?\n- Additional assumptions: I believe there should also be an assumption about the concepts being uncorrelated. I would imagine that if different concepts are correlated in the dataset, then the authors method could accidentally erase more concept, e.g. using one of the experiments, erasing religion could potentially erase also ethnicity information. Could the authors comment on this, potentially also from the perspective of societal impacts.\n- As a sanity check, have the authors tested their method on the bottleneck layer of a concept bottleneck neural network [Koh, 2020]? I would imagine that if the method worked properly, then the authors could clearly see that one of the dimension in the bottleneck layer would essentially become constant.", "limitations": "Only few limitations are discussed from a techincal perspective. Societal impacts are also very briefly mentioned.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- (Significance) Concept erasure is a timely topic for AI safety, and an interesting topic per se in the broader interpretability field.\n- (Novelty) Kernel-trick, coupled with rate-distortion theory seems like a reasonable novel contribution.\n- (Soundness) Experiments seem convincing to support authors claims", "weaknesses": "- (Soundness) Assumptions and drawbacks should be further clarified. See section below.\n- (Theoretical results) I am unsure how useful is the proven lemma in the overall narrative of the paper. The only mentioned conclusion is the one in line L.202. However, this conclusion can be reached by simply looking at equation 2. And actually the conclusion is wrong if we were to only look at the inequality: since R(Z) is the *lower* bound, increasing R(Z/K) does not necessarily imply an increase in R(Z).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review and questions. Please find our responses below. \n\nQuestions:\n\n(Q1) We are unfamiliar with and did not get to try alternative formulations of the rate-distortion function. However, even in the non-parametric setting where the representations are available as finite samples, the rate-distortion formula (Equation 1 in our paper) provides a good upper bound. This has been shown in Appendix A of this paper [1]. We had mentioned it briefly in Lines 131-132, but will add more details in the paper. \n\n[1] Segmentation of Multivariate Mixed Data via Lossy Data Coding and Compression, Yi Ma, TPAMI 2007.   \n\n\n(Q2) Indeed, the determinant scales badly with the number of samples in $Z$. In practice, the network is trained using mini-batches where the number of samples is significantly smaller compared to the dataset size. Even with relatively small mini-batch sizes  we are able to achieve good performance with KRaM. The batch size provides one simple way to mitigate computation bottlenecks based on the available resources. In practice, we found our method to be quite fast, for a batch size of 200, dataset size ~10K, representation size 300, 100 epochs of training completed within 1 minute on an Nvidia Quadro RTX-5000 GPU.\n\nOther works that focused on variational formulations of a different rate-distortion-based objective function in Proposition 3.1 in [2] for efficiently computing the rate distortion. We view this as orthogonal to the contributions of KRaM.\n\n[2] Efficient Maximal Coding Rate Reduction by Variational Forms, Christina Baek, CVPR 2022. \n\n(Q3) Yes, your observation is correct. If the user is erasing a concept label using KRaM (or other concept erasure frameworks) then other correlated concepts can also be erased. In the extreme case, you can think about retrieving a concept that is 100% correlated with the erased concept, which won’t be possible. In general, the correlation between different concepts or latent factors depends on the modeling techniques used to produce the data representations and it is difficult to provide guarantees. \n\nWe briefly talk about this in the broader impact section in Appendix E and will add more details in the paper. \n\n(Q4) Thanks for your suggestion.\n\nDue to time constraints, we experimented with a simpler setup involving concept bottleneck neural networks, which is a step towards the experiment you suggest.\n\n*Setting*:\n*  Trained a model (inception v3) to predict concepts given an image.\n* Performed concept erasure using KRaM on the representations from this model. \n* Post-concept erasure the representations were used to predict the target task (with 200 labels) using a separate classifier. \n* Since *this classifier has access only to the concepts and not the original image* performing concept erasure should make it incapable of predicting the target class.\n\nWe perform vector-valued concept erasure to delete a subset of the concepts (there are a total of 112 attributes). The results are reported below:\n\n|% Concepts Erased| Acc. (y) | \n| :---        |    :----:   |\n|0% |69.5 |\n|12.5% |42.7 |\n|25% |37.0 |\n|50% |35.4 |\n|100% |0.08 |\n\nWe observe that as more concepts are erased the target task performance decreases. We observe that when 100% of the concepts are erased the representation cannot be used to predict the target task, which shows the effectiveness of KRaM. We draw this conclusion because the representations include only features corresponding to their concepts and not the underlying image based on the way the model was trained. \n\n\nWeaknesses:\n\n(W2) Thanks for pointing this out. Your observation is correct and the statement is incorrect. However, we did observe this empirically where maximizing $R(Z|K)$ also results in an increase in $R(Z)$ (Section 5.2 in Figure 6(a)). We will modify the statement in the paper. \n\nApart from this, we find that the bounds of $R(Z|K)$ can be used to find the overall bound for the objective in Equation 4.\n\n$[-\\lambda b, \\max((1+\\lambda)U-\\lambda b, (1-\\lambda)U+\\lambda b)]$\n\nwhere $U = \\frac{n}{2} \\log_2 (1 + d/n \\epsilon^2)$ and assuming $\\lambda \\in [0, 1]$ is the upper bound derived in Lemma 1. \n"}, {"review_id": "xKtMerW2Uq", "reviewer": "Reviewer_x4Ej", "summary": "The KRaM framework is proposed in this paper to perform concept erasure. The approach aims to differentiate similar concept labels in the learned representation space while preserving other information. The paper demonstrates the effectiveness of KRaM in erasing various concepts across different forms of representation (i.e., categorical, continuous, and vector-value variables) through theoretical analysis and empirical setups. Additionally, the paper proposes a clear measurement to evaluate the alignment of representations before and after concept erasure.", "questions": "Is it possible to apply KRaM to image-based datasets? Doing so could potentially enhance the proposed method's ability to generalize across various modalities.\n", "limitations": "The paper presents a novel framework that should potentially be applied to various modalities. Finding and understanding the exact information which is altered by concept erasure is a future work and has positive societal impact to the field.\n\n", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This paper presents several strengths, including a clear and well-written introduction that guides the reader to understand the problem and the motivations behind it, as well as providing helpful background study. They provide clear setups to study and offer results empirically and theoretically. This paper proposes a new approach to address the limitation of prior works, which did not evaluate the amount of information preserved in the representation. The proposed method uses a clever and heuristic idea to measure alignment by comparing overlapping neighborhoods of the original representation.", "weaknesses": "Here are some potential improvements to the original content:\n\n1. In line 273, it is stated that a more effective method of erasing concepts would result in low accuracy and high mean squared error (MSE) for the deleted concept. This statement may seem counterintuitive, since KRaM claims to retain some original information. However, as shown in Figure 3, the performance of downstream task drops relatively significantly when concepts such as Christian, Jewish, and Muslim are erased. The relationship between utility and representation preservation needs more explanation.\n\n2. The author has presented a heuristic approach to determine the amount of information that is retained in a representation. However, it is unclear how this approach can guarantee that the representation is altered according to the given concept, particularly in the continuous form of representation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review and questions. Please find our responses below.\n\nWeaknesses:\n\n(W1) We would like to clarify the claim made in the paper. \n\nWe emphasize that the purpose of concept erasure is to make it difficult to predict the deleted concept from the representation set. And indeed, our empirical results show that prediction of deleted concepts is difficult post-concept erasure. Poor prediction performance means that any classifier trying to predict the deleted concept would obtain low accuracy (for categorical variables) and high MSE (for continuous variables).\n\nIn Figure 3, we **do not report the downstream task** performance but performance of detecting the deleted concept. The downstream performance is reported in Line 300. We observe that there is minimal impact on the toxicity classification performance: pre-concept erasure: 93.2% $\\rightarrow$ post-KRaM 92.1%\n\nIn this setup reported in Figure 3, we erase vector-valued concepts where the vector has dimensions [buddhist, christian, hindu, jewish, muslim, others]. After deleting these vector concepts, we probe the modified representations for each of the religion attributes individually (reported in Figure 3(a)) and compute the fairness in the downstream task using GDP values, Figure 3(b) (where lower GDP means indicates a fairer predictor). In Figure 3(a), we observe that the MSE of predictors trying to predict religion increases significantly after KRaM. This implies that the modified representations contain much less information about religion, which is expected. \n\n(W2) We would like to clarify the intuition behind the proposed approach. \n\nThe approach **does not** measure the information content at the level of individual representations. Instead, the alignment score is used to compare the information content between two sets of representations. The motivation behind this approach comes from the fact that the nearest neighbour structure in the representation space contains useful information for downstream tasks. Consider the case of classification using a kNN classifier, where a test sample is assigned the majority label of its nearest neighbours. Now, if the nearest neighbor structure is destroyed it won’t be possible to predict the right labels and therefore the downstream task information is lost. Note that the alignment score is used to measure overall information alignment and does not account for the concept being erased. \n\nIn all of our experiments, we evaluate the representation quality of KRaM using multiple different methods apart from $A_k$ scores like downstream tasks, rank, and word embedding similarity as reported in Tables 1, 2 and Figure 4.\n\nQuestions:\n\n(Q1) Yes, it is possible to perform concept erasure using KRaM on image-based datasets. We report the results of concept erasure on two different datasets below\n\n\n*CelebA*: \n\nSetting:\n* Dataset: We select a subset of CelebA, which contains images of people’s faces\n* Target binary label: attractiveness \\in [attractive, not attractiveness]\n* Concept to be erased: whether the face [has makeup, doesn’t have makeup]\n\n\nObservations:\n*  Prior to the concept-erasure makeup factor (concept to be deleted) could be predicted with 85.7% accuracy\n* Post KRaM the prediction accuracy decreased to 69.6%\n* The demographic parity of the predictions also improved from 0.94 to 0.54. This shows the effectiveness of KRaM in removing the makeup concept.\n\n\n*Colored MNIST*: \n\nSetting:\n\n* Dataset: We follow the setup of [1] to create a biased version of the MNIST dataset.\n* Labels: The background color of the digits is made to be well correlated with the digit in the training set. But no such correlation exists in the test set. We use 0.8 correlated between the background color and digit label.\n* Concept to be erased: Background color is the concept to be erased.\n\nObservations:\n\n* Naively training a classifier on the images will perform poorly on the test set as the classifier can easily overfit on the background color. The digit information could be predicted with an accuracy of 79.9%.\n* Post-concept erasure we observe that the classifier’s performance improves from 79.9% to 87.1%. This shows the effectiveness of KRaM to remove background information and help the classifier generalize better. \n\n\n[1] Learning De-biased Representations with Biased Representations, Bahng et al. ICML 2020.\n"}, {"review_id": "kjLyy76LQp", "reviewer": "Reviewer_iqZj", "summary": "This paper considers the concept erasure task removing an attribute from distributed representations while retaining other information from the original representation space as much as possible. Specifically, it proposes a Kernelized Rate-Distortion Maximizer (KRaM) framework and provides a theoretical analysis for the proposed algorithm. Finally, various experiments are conducted to show the effectiveness of KRaM.", "questions": "See weakness.", "limitations": "None", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The topic considered in this work is important/interesting and the structure of the paper is well-organized.", "weaknesses": "1. The contributions of this paper are unclear, and the novelty is also insufficient. From my understanding, the major weakness is that the KRaM is just a simple application of the kernels to the rate-distortion maximizer framework. Meanwhile, the strengths/differences between the proposed KRaM and the current concept erasure methods such as [1,2,3]. The authors should make more discussions in the rebuttal phase.\n2. The theoretical results are also limited because it merely applies to the RBF kernel. Thus, it is better to show the theoretical results for other kernels.\n3. The experiments are insufficient to support the effectiveness of the proposed KRaM. Because 1) there are a few competitive methods [1,2] that are not considered in this work; 2) the improvements of the KRaM against the current methods are limited. In particular, in Tab.2, compared with RLACE, the performance gap is sharp such as Acc.(y) and A_k.\n4. Why do we need to train an extra concept function f? What will happen to the performance if we only use the outputs of a pre-trained model as f?\n\nRef:\n\n[1] Learning Diverse and Discriminative Representations via the Principle of Maximal Coding Rate Reduction.\n\n[2] Kernelized Concept Erasure.\n\n[3] Probing Classifiers are Unreliable for Concept Removal and Detection.\n\n\n==================================================\n\nPost-rebuttal:\n\nMy concerns are basically solved. So I'd like to raise my score to BA.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your review and questions. Please find our responses below.\n\n\n\n(W1) \nWe believe there may be a misunderstanding here. And so we would like to clarify things in detail because we firmly believe that our work is not just a simple introduction of kernels to [1]. In fact, **our task and final objectives are distinctly unique and novel** compared to [1]. Let us now specify our reasoning:\n\n* The rate-distortion maximization framework proposed in [1] was for classification tasks, not concept erasure, which relies on the rate-distortion formulation (Equation 1).\n* The original closed formula for rate-distortion (Equation 1 in our paper) was first proposed in [4]. Several works have built on rate-distortion to use it in multiple applications like segmentation [4, 5], classification [1], incremental learning [6],  autoencoders [7], among others.\n* The only work that used rate distortion in fairness is FaRM [8], which we extensively compare in Tables 1 and 2.\n* We have performed new experiments to compare with [2] and report the results on categorical concept erasure below: \n\n\n*DIAL Results*\n\n|Method| Acc. (y) $\\uparrow$      | Acc. (a) $\\downarrow$      |  DP $\\downarrow$ |$A_k$ $\\uparrow$ |\n| :---        |    :----:   |:----:   |:----:   |:----:   |\n|Original (w/o concept erasure) |75.5 |87.7 |0.26| 1.0|\n|Kernelized Concept Erasure [2]|75.0 |80.1 | 0.12| 0.70|\n|KRaM (Ours)|72.4 |54.0 | 0.08| 0.74|\n\n*GloVe Results*\n\n|Method| Acc. (a) $\\downarrow$ |$A_k$ $\\uparrow$ |Rank $\\uparrow$|\n| :---        |    :----:   |:----:   | :----:   | \n|Original (w/o concept erasure) |100 |1.0 |300|\n|Kernelized Concept Erasure [2]|63.5 |0.62 | 100|\n|KRaM (Ours)|52.6 |0.65 | 246|\n\nFrom the above results, KRaM performs significantly better than [2] in erasing concepts achieving far better Acc. ($a$) scores while retaining a significant amount of prior information as seen through the $A_k$ scores. Also, note that the mentioned method can only handle categorical concept erasure while KRaM can perform categorical, continuous, and vector-valued concept erasure. \n\nRegarding [3], we find that this mentioned paper is an analysis work finding several pitfalls of nullspace projection concept erasure approaches. As our proposed method does not rely on a probing classifier during concept erasure we do not share similar vulnerabilities. \n\n[1] Learning Diverse and Discriminative Representations via the Principle of Maximal Coding Rate Reduction. \n\n[2] Kernelized Concept Erasure. \n\n[3] Probing Classifiers are Unreliable for Concept Removal and Detection.\n\n[4] Segmentation of Multivariate Mixed Data via Lossy Data Coding and Compression, Yi Ma, TPAMI 2007. \n\n[5] Unsupervised segmentation of natural images via lossy data compression. Young, 2008\n\n[6] Incremental Learning via Rate Reduction\n\n[7] Closed-Loop Transcription via Convolutional Sparse Coding.\n\n[8] Learning Fair Representations via Rate-Distortion Maximization, TACL 2022. \n\n(W2) The only assumptions that we used in our proof are that $K$ is PSD (holds for all kernels) and $d(x, x)=0$, $K(0)=1$. The condition $K(0)=1$ holds for a lot of kernels. We will restate our lemmas to include these exact conditions. \n\nMoreover, if we consider the general case where $K(0)=c$, $c$ being a constant, we modify the bounds as follows:\n\n$c^nR(Z) \\leq R(Z|K) \\leq \\frac{n}{2}\\log_2 (1+\\frac{cd}{n\\epsilon^2})$\n\nProof sketch: The above can be proved by simply replacing $b_{ii}=c$ in line 537 and $\\lambda_i(ZZ^T \\odot K) = cn/n=c$. \n\n\n(W3) *Concern 1*: We have added results for the mentioned baselines and reported the results above as a response to your first question. \n\n*Concern 2*: We would like to add more context to help the reader navigate the results better. \n\nThe primary goal of concept erasure is to delete a specified concept even at the cost of removing additional information. Unlike adversarial learning, in this application, we are not trying to achieve a balance between fairness and target tasks. However, we need to ensure that the network doesn’t produce random representations and lose all information in the process. We evaluate this using $A_k$ and other downstream tasks. \n\nRLACE achieves better $A_k$ and Acc. ($y$) because it cannot remove the desired concept properly. If you observe the Acc. ($a$) (in Table 2) of RLACE it is significantly higher than KRaM. This shows that it is unable to delete concepts robustly, which is the primary objective. This phenomenon is consistently observed in Table 2 where RLACE reduces gender accuracy by only 5% (compared to 47.2% KRaM) and DP improvement on DIAL is 0.08 by RLACE compared to (0.18 by KRaM).\n\nIn general, slightly lower Acc. ($a$) and $A_k$ obtained by KRaM indicates that other information often gets compromised in order to delete the concept robustly. \n\n(W4) We performed experiments with outputs from a pre-trained model. Specifically, we use GPT-3.5 representations for vector-valued concept erasure reported in Figure 3.\n\nThe motivation behind concept erasure stems from the application where a data producer is distributing representations to different customers and erasing specific concepts based on the customer’s application. In this case, it is beneficial to use a separate function $f$ for each customer so that the underlying foundation model can be reused. In theory, the user can treat the whole foundation model as $f$ and train it for concept erasure. But the model would not be useful in future applications that need the deleted or related concepts. \n"}]

Author rebuttal:
We thank the reviewers for their valuable feedback and suggestions. We believe that we have carefully considered all the comments raised by the reviewers. We have conducted several additional experiments and theoretical analysis as summarized below:

# New Experiments & Results

**New Baselines**:

  * Mutual Information-based bounds for categorical concept erasure
    * Methods: MIFR, CCL, ICVAE 
    * Datasets: DIAL & GloVe
    * Observation: KRaM is able to remove concepts robustly while retaining significant amount of prior information compared to baselines.
    * Report to Reviewer yWDJ [here](https://openreview.net/forum?id=I6aOjhpcNQ&noteId=Qows1Jde4O).
* Analysis using concept bottleneck neural networks
  * Model trained & concept erasure experiment on CUB dataset
  * Observation: As more concepts are erased it becomes difficult to predict target labels from the concept bottleneck layer (which is the desired outcome).
  * Report to Reviewer GgzL [here](https://openreview.net/forum?id=I6aOjhpcNQ&noteId=o1xDLck1hN).
* Image Domain experiments: 
  * Evaluated KRaM on two datasets: CelebA & Colored MNIST
  * Observation: KRaM is able to remove concepts robustly leading to improved DP and generalization respectively.
  * Report to Reviewer x4Ej [here](https://openreview.net/forum?id=I6aOjhpcNQ&noteId=u2Nfl0IqJy).
* We have compared KRaM with the kernel concept erasure method on GloVe and DIAL datasets. The results are reported in the response to Reviewer iqZj.
* Comparison to Kernelized Concept Erasure:
  * Dataset GloVe and DIAL
  * KRaM achieves better concept erasure and information retention scores than this baseline. 
  * Report to Reviewer iqZj [here](https://openreview.net/forum?id=I6aOjhpcNQ&noteId=YouK0TQGUL).

# Theoretical Analysis

* We have clarified the statements related to Lemma 1. We also added results about how these bounds can be utilized to find the bounds of the overall objective (response to Reviewer GgzL [here](https://openreview.net/forum?id=I6aOjhpcNQ&noteId=o1xDLck1hN)). 
* We have clarified the exact conditions on the kernel functions required for lemma 1 to hold. We have also added the results for a general class of kernels (response to Reviewer iqZj [here](https://openreview.net/forum?id=I6aOjhpcNQ&noteId=YouK0TQGUL)). 



Meta-review: This paper studies a relatively new area in the broad area of machine unlearning. It specifically studies "concept" erasure, where the goal is to take a set of representations and remove the influence of a particular concept while leaving other information unchanged. The key idea is to adopt a kernelized rate-distortion framework to perform erasure. This is not a new idea, but the authors generalize it to handle a lot of possible notions of "concept".

Reviews are largely quite positive, noting good results trading off erasure ability vs. maintaining information. This is a solid contribution to an important developing area.
Decision: Accept (poster)