Paper:
PRIVACY-PRESERVING REPRESENTATION LEARNING
Deep learning and latest machine learning technology heralded an era of success in data analysis. Accompanied by the ever increasing performance, reaching super-human performance in many areas, is the requirement of amassing more and more data to train these models. Often ignored or underestimated, the big data curation is associated with the risk of privacy leakages. The proposed approach seeks to mitigate these privacy issues. In order to sanitize data from sensitive content, we propose to learn a privacy-preserving data representation by disentangling into public and private part, with the public part being shareable without privacy infringement. The proposed approach deals with the setting where the private features are not explicit, and is estimated though the course of learning. This is particularly appealing, when the notion of sensitive attribute is "fuzzy". We showcase feasibility in terms of classification of facial attributes and identity on the CelebA dataset. The results suggest that private component can be removed in the cases where the the downstream task is known a priori (i.e., "supervised"), and the case where it is not known a priori (i.e., "weakly-supervised").

Review:
This paper investigates the use of variational auto-encoders (VAEs) and disentanglement to create high quality data representations that hide sensitive attributes. The authors consider two settings: (1) a supervised setting where both the sensitive labels and the downstream machine learning task labels are available to the data holder, and (2) a weakly supervised setting where only sensitive attributes are available. For both settings, the authors propose creating data representations that have 2 components: component 1 captures any information in the data bout the sensitive attributes, and component 2 captures everything else (especially the information useful for a downstream machine learning task). The goal is to ensure that these two components are disentangled.  This is done by training classifiers on each component: 2 classifiers that try to reconstruct the sensitive attributes from each component separately (and in the supervised setting, 2 other classifiers that guess the downstream ML task from each component separately). The overall loss captures all components and ensures that one cannot reconstruct the sensitive attributes from component 2. 
Overall, the paper addresses an interesting and timely problem that is of great relevance to this community. However, despite being generally clear, the paper has many grammatical errors and typos. In its current shape, the paper cannot be published. 
More importantly, the paper has a number of issues that need to be improved:
1. The introduction makes a number of claims that are incorrect. For instance, the introduction claims that under differential privacy (and refers to Abadi et al.), machine learning models are learned from anonymized data and that complex training procedures run the risk of exhausting the budget before convergence. This is not true because under the classical setting of differential privacy, the models are trained on clean data BUT the process of learning is anonymized (see DP-SGD from Abadi et al.). More importantly, recent research and results in this space indicate that one can train high quality machine learning models with strong differential privacy guarantees (check McMahan et al. ICLR18: Learning Differentially Private Recurrent Language Models). Further, the authors claim that Federated Learning does not allow for the use of the trained model in a central setting. This is also not true because federated learning is an approach to train models on massively decentralized data -- in a way that is orchestrated by a service provider. The learned model can be used in a centralized or decentralized service. Moreover, the communication cost of training models under federated learning may be lower than communicating the data (several hundreds if not thousands of high resolution images) to a central service provider, so the claims about communication are not always correct. Finally, the authors claim that federated learning and differential privacy are useful when the private attributes are known a priori and these approaches fail to provide privacy protections when the private information contained in the dataset isn't identified. This is wrong. Both approaches do not require the knowledge of private information. They, however, require the knowledge of the downstream machine learning task -- something that may not always defined a priori.
2. The privacy guarantees provided by the authors' approach are rather weak and unclear. (1) They assume that a trusted data holder already access to the dataset and wants to release private representations. In the supervised setting, why not just revealing the learned model? In the weakly supervised setting, where will the downstream machine labels come from? Are these representations released only for unsupervised learning tasks? This should be clarified -- and the experiments at the end should reflect this. (2) The privacy guarantees are with respect to (a) a computationally and statistically bounded adversary (i.e. there may very well be stronger adversaries with access to side information that can perfectly reconstruct the sensitive attributes),  and (b) pre-defined sensitive attributes (i.e. there may be other sensitive attributes that one can learn from the published representations that are not captured by this framework). 
3. The paper makes no attempt to properly survey the literature on learning representations under censorship and fairness constraints. For example, they do not reference and compare against: (a) Censoring Representations with an Adversary (https://arxiv.org/abs/1511.05897), (b) Learning Adversarially Fair and Transferable Representations (https://arxiv.org/abs/1802.06309), (c) Context-Aware Generative Adversarial Privacy (https://arxiv.org/abs/1710.09549), (d) Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring Constraints (https://arxiv.org/abs/1910.00411), and many others. Without a clear (empirical) comparison to these works, the benefits of the proposed approach are unclear.
4. The proposed method for disentanglement does not scale to non-binary sensitive attributes (because of the blowup in the number of classifier pairs that would need to be trained to ensure disentanglement). Thus, this approach may be limited to cases with a few sensitive attributes. 
5. The authors are encouraged to show the learned representations (so that one could verify with the naked eye that the representations are indeed disentangling the sensitive attributes).