Paper: MaSS: Multi-attribute Selective Suppression for Utility-preserving Data Transformation from an Information-theoretic Perspective (ICLR-2024)

Reviewer comment (Experiments):
The dataset lacks a detailed description. It would also be good to have a table that describes the size of the dataset along with some other information that would give the reader a clearer picture of the dataset.

Author response:
We thank the reviewer for pointing out this problem. The detailed descriptions of datasets, including size, classes, split, preprocessing, and other basic information, are included in Appendix B of the revised manuscript.

Reviewer comment (Experiments):
Lack of comparison with a state-of-the-art method ("Li M, Xu X, Fan H, et al. STPrivacy: Spatio-Temporal Privacy-Preserving Action Recognition[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023: 5106-5115.").

Author response:
We thank the reviewer for pointing out this related work. STPrivacy (Li et al., 2023) proposed an insightful framework for privacy-preserving action recognition (PPAR) for 3D video data, which combined sparsification (removing privacy-leaking action-irrelevant tubelets from ViT input) and anonymization (removing privacy information adversarially by maximizing CE loss). STPrivacy was specially tailored for video data and ViT model, overcoming the dynamic utility loss and privacy leakage of previous frame-based PPAR methods. However, this specialization also hindered its generalizability to other domains, which made it inapplicable to our settings. However, as a remedy, we compared our method with two baseline methods mentioned in the STPrivacy paper, namely PPDAR (Wu et al., 2020) (named VITA in the STPrivacy paper) and SPAct (Dave et al., 2022). The results of PPDAR is shown in Table 1, 2, 4, 5, 7 in our paper. The results of SPAct is shown in the Table 1 below. We can observe that MaSS achieves slightly lower NAG on digit compared to SPAct, but significantly lower NAG on all sensitive attributes (up to 5\%), which shows that our method can achieve a better trade-off between suppression and preservation. However, please note that SPAct did not consider preserving unannotated useful attributes.

**Table 1**: Comparison of the classification accuracy and NAG between MaSS and SPAct on AudioMNIST. We suppress gender, accent, age, id, while preserve digit as annotated useful attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
|No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
| SPAct | 0.8087 (0.0442) | 0.6833 (0.0001) | 0.1753 (0.0108) | 0.0707 (0.0560) | 0.9948 (0.9970) |
| MaSS | 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1662 (0.0000) | 0.0183 (0.0017) | 0.9933 (0.9953) |

References: 

- Li, Ming, et al. "STPrivacy: Spatio-Temporal Tubelet Sparsification and Anonymization for Privacy-preserving Action Recognition." arXiv preprint arXiv:2301.03046 (2023).

- Wu, Zhenyu, et al. "Privacy-preserving deep action recognition: An adversarial learning framework and a new dataset." IEEE Transactions on Pattern Analysis and Machine Intelligence 44.4 (2020): 2126-2139.

- Dave, Ishan Rajendrakumar, Chen Chen, and Mubarak Shah. "Spact: Self-supervised privacy preservation for action recognition." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022.

Reviewer comment (Theory):
The authors need to provide more detailed explanations and justifications for their proposed techniques, specifically why contrastive learning is suitable for protecting unannotated attributes and how it ensures the predictability of annotated attributes.

Author response:
InfoNCE contrastive learning loss (Oord et al., 2018) is a classical contrastive learning loss, which learns useful representations of data by making the representations of positive samples (similar or related samples) closer while pushing the representations of negative samples further apart from the anchor. The sampling strategy in our framework is as follows. Suppose we have ${K+1}$ samples $ \\{ x _i \\}  _{i=1}^{K+1}$ in a mini-batch. We first pass them through the feature extractor $P _\eta(F|X)$ and data transformation module to sample a batch of $ \\{ f _i \\}  _{i=1}^{K+1}$ and $ \\{ x' _i \\}  _{i=1}^{K+1}$ respectively. Then suppose we choose the $j$-th feature $f _j$ as the anchor. Then the corresponding $x' _j$ would be designated as a positive sample, and all other $x' _{i \neq j}$ are  designated as negative samples. After sampling, we calculate the contrastive learning loss as Equation 14 in our paper. For training stability, in our implementation each of the $K+1$ features in a batch are used as an anchor once and then averaged. An analogous strategy was used when anchors are chosen from $x'$.

InfoNCE Contrastive learning is suitable in our design because it is a proper approximation to $I(F;X')$ (and $I(X;X')$), so that it can be used to maximize $I(F;X')$ thus protect unannotated useful attributes in the transformed data. Contrastive learning loss may help with preserving annotated useful attributes as well. But the annotated useful attributes preserving module is taking the primary responsibility, by ensuring the predictability of useful attributes from the transformed data.

Besides, contrastive learning loss also succeeds in that it does not assume the distribution of $X, X'$. It can be universally applied to images, language, sensor signals, etc, with few adjustments. Another important merit of contrastive learning is its advanced empirical performance. We conducted an ablation experiment where we replaced the contrastive learning loss with MSE reconstruction loss (denoted as MaSS-MSE). The results are shown in Table 2 and Table 3. MaSS-NF means MaSS trained without unannotated useful attributes preservation. We can observe that the NAG of digit is significantly lower without unannotated attribute preservation. We can also observe that MaSS achieves higher NAG on digit than MaSS-MSE, as well as lower NAG on other sensitive attributes, which demonstrates the strong empirical performance of contrastive learning loss compared to MSE reconstruction loss.

**Table 2**: Comparison of the classification accuracy and NAG between MaSS and ablations on AudioMNIST. We suppress gender, accent, age, ID, while preserve digit as if an unannotated attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
| No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
| MaSS-NF | 0.8000 (0.0000) | 0.6833 (0.0001) | 0.1658 (0.0000) | 0.0152 (0.0000) | 0.2657 (0.1846) |
| MaSS-MSE | 0.8002 (0.0008) | 0.6833 (0.0001) | 0.1683 (0.0020) | 0.0462 (0.0306) | 0.9542 (0.9517) |
| MaSS | 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0195 (0.0029) | **0.9683 (0.9675)** |

**Table 3**: Comparison of the classification accuracy and NAG between MaSS and ablations on MotionSense.  We suppress gender, ID, while preserve activity as if unannotated useful attribute.

| Method | gender ($\downarrow$) | ID ($\downarrow$) | activity ($\uparrow$) |
|---|---|---|---|
| No suppression| 0.9026 (1.0000) | 0.9817 (1.0000) | 0.9764 (1.0000) |
|Guessing| 0.0533 (0.0000) | 0.5699 (0.0000) | 0.4663 (0.0000) |
| MaSS-NF| 0.0508 (0.0000) | 0.5699 (0.0000) | 0.8374 (0.7275) |
| MaSS-MSE | 0.0754 (0.0260) | 0.5734 (0.0085) | 0.8823 (0.8156) |
| MaSS | 0.0555 (0.0026) | 0.5686 (0.0000) | **0.9242 (0.8977)** |



Reference:

- Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748, 2018.

Reviewer comment (Writing):
The authors could consider providing more detailed explanations of the loss functions used in their method, such as the InfoNCE Contrastive Learning Loss.

Author response:
InfoNCE contrastive learning loss (Oord et al., 2018) is a classical contrastive learning loss, which learns useful representations of data by making the representations of positive samples (similar or related samples) closer while pushing the representations of negative samples further apart from the anchor. The sampling strategy in our framework is as follows. Suppose we have ${K+1}$ samples $ \\{ x _i \\}  _{i=1}^{K+1}$ in a mini-batch. We first pass them through the feature extractor $P _\eta(F|X)$ and data transformation module to sample a batch of $ \\{ f _i \\}  _{i=1}^{K+1}$ and $ \\{ x' _i \\}  _{i=1}^{K+1}$ respectively. Then suppose we choose the $j$-th feature $f _j$ as the anchor. Then the corresponding $x' _j$ would be designated as a positive sample, and all other $x' _{i \neq j}$ are  designated as negative samples. After sampling, we calculate the contrastive learning loss as Equation 14 in our paper. For training stability, in our implementation each of the $K+1$ features in a batch are used as an anchor once and then averaged. An analogous strategy was used when anchors are chosen from $x'$.

InfoNCE Contrastive learning is suitable in our design because it is a proper approximation to $I(F;X')$ (and $I(X;X')$), so that it can be used to maximize $I(F;X')$ thus protect unannotated useful attributes in the transformed data. Contrastive learning loss may help with preserving annotated useful attributes as well. But the annotated useful attributes preserving module is taking the primary responsibility, by ensuring the predictability of useful attributes from the transformed data.

Besides, contrastive learning loss also succeeds in that it does not assume the distribution of $X, X'$. It can be universally applied to images, language, sensor signals, etc, with few adjustments. Another important merit of contrastive learning is its advanced empirical performance. We conducted an ablation experiment where we replaced the contrastive learning loss with MSE reconstruction loss (denoted as MaSS-MSE). The results are shown in Table 2 and Table 3. MaSS-NF means MaSS trained without unannotated useful attributes preservation. We can observe that the NAG of digit is significantly lower without unannotated attribute preservation. We can also observe that MaSS achieves higher NAG on digit than MaSS-MSE, as well as lower NAG on other sensitive attributes, which demonstrates the strong empirical performance of contrastive learning loss compared to MSE reconstruction loss.

**Table 2**: Comparison of the classification accuracy and NAG between MaSS and ablations on AudioMNIST. We suppress gender, accent, age, ID, while preserve digit as if an unannotated attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
| No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
| MaSS-NF | 0.8000 (0.0000) | 0.6833 (0.0001) | 0.1658 (0.0000) | 0.0152 (0.0000) | 0.2657 (0.1846) |
| MaSS-MSE | 0.8002 (0.0008) | 0.6833 (0.0001) | 0.1683 (0.0020) | 0.0462 (0.0306) | 0.9542 (0.9517) |
| MaSS | 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0195 (0.0029) | **0.9683 (0.9675)** |

**Table 3**: Comparison of the classification accuracy and NAG between MaSS and ablations on MotionSense.  We suppress gender, ID, while preserve activity as if unannotated useful attribute.

| Method | gender ($\downarrow$) | ID ($\downarrow$) | activity ($\uparrow$) |
|---|---|---|---|
| No suppression| 0.9026 (1.0000) | 0.9817 (1.0000) | 0.9764 (1.0000) |
|Guessing| 0.0533 (0.0000) | 0.5699 (0.0000) | 0.4663 (0.0000) |
| MaSS-NF| 0.0508 (0.0000) | 0.5699 (0.0000) | 0.8374 (0.7275) |
| MaSS-MSE | 0.0754 (0.0260) | 0.5734 (0.0085) | 0.8823 (0.8156) |
| MaSS | 0.0555 (0.0026) | 0.5686 (0.0000) | **0.9242 (0.8977)** |



Reference:

- Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748, 2018.

Reviewer comment (Experiments):
The paper introduces an interesting concept in Theorem 3.1, highlighting the importance of mutual information constraints 'm' and 'n' in the context of privacy and utility trade-offs. However, it is essential to note that the experiments lack a corresponding exploration of these constraints. These constraints likely play a pivotal role in balancing sensitive attribute accuracy and useful attribute accuracy. The reported experimental results suggest that MaSS might not simultaneously achieve the best performance for both types of attributes. Therefore, it is recommended to conduct experiments with varying constraints to gain a deeper understanding of their impact.

Author response:
**A1**. We conducted experiments to show the effect of varying constraint, in which we took gender, accent, age and ID as sensitive attributes and digit as an annotated useful attribute on the AudioMNIST dataset. We fixed $m=0$ for gender, accent and age and $n=2.3$ for digit (its maximal value). Then we varied $m$ for ID from $0$ to $1.46$ (its maximal value). The results are shown in Table 1. We can observe that as $m$ increases, the constraint is gradually loosened, which results in the gradually increasing accuracy and NAG for ID.

**Table 1**: Varying the suppression constraint $m$ on AudioMNIST. We suppress gender, accent, age, ID, while preserve digit as if an annotated useful attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
|No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
|MaSS $m_{id}$=0.0| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1662 (0.0000) | 0.0183 (0.0017) | 0.9933 (0.9953) |
|MaSS $m_{id}$=0.3| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1665 (0.0000) | 0.0598 (0.0447) | 0.9938 (0.9959) |
|MaSS $m_{id}$=0.6| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1668 (0.0002) | 0.1120 (0.0988) | 0.9940 (0.9961) |
|MaSS $m_{id}$=0.9| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1670 (0.0004) | 0.1493 (0.1376) | 0.9937 (0.9957) |
|MaSS $m_{id}$=1.2| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.1963 (0.1863) | 0.9928 (0.9948) |
|MaSS $m_{id}$=1.46| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.2597 (0.2520) | 0.9937 (0.9957) |

Reviewer comment (Theory):
The theoretical argument presented in Theorem 3.2 may raise some questions. Specifically, the relevance of unannotated useful attributes to the tasks is highlighted, which could vary across different scenarios. The paper should address this issue and provide an ablation study of the contrastive learning module to support the claims made in Theorem 3.2. This would provide stronger evidence and clarity regarding the relationship between learned attributes and sensitive attributes.

Author response:
**A2**. Theorem 3.2 provided an operational upper bound for the learning objective $I(X';F)$, namely $I(X';F) \leq H(X|S _i) + m _i$. The detailed proof can be found in Appendix A.2. The value of the upper bound  ($H(X|S _i) + m _i$) is independent from the parameters of our model, which means that the unannotated useful attributes preservation module can at most preserve $H(X|S _i) + m _i$ nats (Naperian bits) of information of $F$ in $X'$. 


Besides, $H(X|S _i) + m _i$ is indeed dependent on the dataset and the task. For an extreme example, in a dataset where $X$ is fully decided by $S _i$ ($H(X|S _i)=0$) and $m _i$ is set to 0, then we can have $I(X';F) \leq 0$, which means we can not preserve any information of $F$ in $X'$. On the other hand, if $X$ is conditionally independent from $S _i$ ($H(X|S _i)=H(X)$), we can have $I(X';F) \leq H(X) + m _i$, which is already guaranteed by Data Processing Inequity $I(X';F) \leq I(X'; X) \leq H(X)$. Therefore in this case, Theorem 3.2 no longer casts any additional constraint on $I(X';F)$.

Reviewer comment (Reproducibility):
Clarification is needed on how the positive and negative samples for the InfoNCE loss are determined. Figure 3 suggests that both positive and negative samples come from the transformed data X', but the paper should explain how these samples are chosen, given that the anchor sample is the original data X.

Author response:
**A3**. The sampling strategy in our framework is as follows: Suppose we have ${K+1}$ samples $ \\{ x _i \\}  _{i=1}^{K+1}$ in a mini-batch. We first pass them through the feature extractor $P _\eta(F|X)$ and data transformation module to sample a batch of $ \\{ f _i \\}  _{i=1}^{K+1}$ and $ \\{ x' _i \\}  _{i=1}^{K+1}$ respectively. Then suppose we choose the $j$-th feature $f _j$ as the anchor. Then the corresponding $x' _j$ would be designated as the positive sample, and all other $x' _{i \neq j}$ are  designated as negative samples.  For training stability, in our implementation each of $K+1$ features in a batch are used as an anchor once and then averaged. An analogous strategy was used when anchors are chosen from $x'$.

Reviewer comment (Evaluation):
Regarding the evaluation of sensitive attribute accuracy, it appears that the accuracy of the adversarial classifier is used. It is recommended to consider the approach of training a classifier from scratch on the transformed data, similar to the methodology employed for calculating useful attribute accuracy.

Author response:
**A4**. Although we would not release the labels of sensitive attributes to the public, here for demonstration we make an assumption that the attacker can access the ground truth labels of sensitive attributes as an oracle and retrain the discriminator on the transformed data. The results are shown in Table 2. We can observe that, using MaSS, the accuracy of the retrained discriminator is higher than adversarial discriminator but is still significantly lower than the discriminator trained using the original data. However, since we only intend to release the transformed data without the sensitive attributes labels, we chose to use the accuracy of the adversarially trained discriminator as the quantitative metric.

**Table 2**: Comparison of the accuracy and NAG between a trained-from-scratch discriminator and adversarial discriminator on the Adience dataset.

| Method | gender($\downarrow$)  | 
| -- | -- |
| No suppression    | 0.9774 (1.0000) |
| Guessing | 0.5240 (0.0000) |
| MaSS (discriminator retrained with oracle)   | 0.6029 (0.1740)|  
| MaSS (adversarial discriminator)   | 0.5240 (0.0000) |

Reviewer comment (Experiments):
To provide a more comprehensive assessment of the proposed method, the paper should include comparisons with recent baselines, such as SPAct (CVPR 2022 [1]).

Author response:
**A5**. SPAct did not consider preserving unannotated useful attributes. Therefore for a fair comparison we considered the scenario where we only had annotated attributes. Results are shown in Table 3. We can observe that MaSS achieves slightly lower NAG on digit compared with SPAct, but significantly lower NAG on all sensitive attributes (up to 5\%), which suggests that our method can achieve a better trade-off between suppression and preservation.


**Table 3**: Comparison of the classification accuracy and NAG between MaSS and SPAct on AudioMNIST. We suppress gender, accent, age, id, while preserve digit as annotated useful attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
|No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
| SPAct | 0.8087 (0.0442) | 0.6833 (0.0001) | 0.1753 (0.0108) | 0.0707 (0.0560) | 0.9948 (0.9970) |
| MaSS | 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1662 (0.0000) | 0.0183 (0.0017) | 0.9933 (0.9953) |

Reviewer comment (Novelty):
The topic of concept removal for generative models, while not a central focus, could be related to this paper's context. It is suggested to discuss concept removal in the related works section to provide a broader perspective on the field and to highlight the paper's contributions in relation to existing research.

Author response:
**A6**. We thank the reviewer for pointing out the connection. The similarity between our method and concept removal for generative models lies in that, both of the two fields are aimed at suppressing an undesired attribute from the transformed/generated data. 

However, the key difference is that, concept removal focuses on removing a particular undesired class of an attribute (e.g., one may view an experiment in Gandikota et al. (2023) as removing the class of "Van Gogh" from the attribute of "artistic style", while other artistic style classes are allowed to persist.). In comparison, our proposed framework focuses on removing an entire undesired attribute altogether from the transformed data (e.g., no artistic styles can be recovered from the transformed data.). 

Reference:

- Gandikota, Rohit, et al. "Erasing concepts from diffusion models." arXiv preprint arXiv:2303.07345 (2023).

Reviewer comment (Experiments):
For unannotated useful attribute, depending on the definition of the problem, the setting will be different from the other method. In the paper’s experiments, the authors mention “ALR, BDQ and PPDAR overlook the preservation of unannotated useful attributes”. It could be that those methods, from their problem definition and setting, do not consider so-termed “unannotated useful attributes” in their framework. But one cannot say it is the limitation or fault of those methods. In the fairest way, because of the setting difference, this paper should compare only to those considering “unannotated useful attributes”. Please carefully phrase the comparison to other methods.

Author response:
We thank the reviewer for pointing out this problem. We have revised the discussion in our revised manuscript to establish a fair and clear view on all baselines. For example, we changed the original term "overlook" to "do not consider".

Reviewer comment (Novelty):
For those methods that share exactly the same setting, e.g., GAP and MSDA, from a technical frame design perspective, what is the difference? There is some slight comparison in the paper, e.g., arguing that some of the methods lack theoretical analysis, which is an advantage of this paper. But other than that, if there is an empirical design that is exactly the same as in this paper, then this paper’s contribution will be only theoretical. Thus, please provide a more thorough comparison to the literature under the same setting, which will be helpful to claim the method’s contribution and novelty.

Author response:
We thank the reviewer for the suggestion. The key difference of technical design between our method and GAP, MSDA is that, both GAP and MSDA utilize a heuristic MSE reconstruction loss for preserving unannotated useful attributes, which has inferior empirical performance, and can not be readily generalized to other datasets (e.g. language, etc.). On the other hand, the contrastive learning loss used in our method does not assume the distribution of $X, X'$, and therefore can be universally applied to images, language, sensor signals, etc, with few adjustments to yield good performance. 


References:

- Huang, Chong, et al. "Generative adversarial privacy." arXiv preprint arXiv:1807.05306 (2018).

- Malekzadeh, Mohammad, et al. "Mobile sensor data anonymization." Proceedings of the international conference on internet of things design and implementation. 2019.

Reviewer comment (Novelty):
The paper is limited in terms of novelty. The main contribution of the paper seems to be in its proposal to preserve of *unannotated* features using a self-supervised-learning objective yet this idea of maximising $\mathcal{I}(X; \tilde{X})$, understanding $\tilde{X}$ to be some representation generally, is certainly not novel in and of itself (vide Madras et al., 2018 in the context of the adjacent field of fair-representation learning); the method chosen used to accomplish this maximisation seems, to me, largely incidental -- one can simply view the contrastive loss as an alternative reconstruction loss.

Author response:
**A1**. Our key novelty lies in our proposal of utility preservation, especially for the unannotated attributes from an **information theoretic** perspective, as opposed to purely **heuristic-driven** methods. 

Although similar ideas of preserving generic features and maximizing $I(X;X')$ can be found in the literature, these existing approaches have noticeable limitation in that they only preserve generic features by minimizing a heuristic reconstruction loss, which is limited in that, 1) it is oftentimes not general enough to be applied in different datasets as they might require different ways to measure the reconstruction loss, for example, MSE for image and Cross-entropy for language; and 2) its performance is not supported by information theoretic analysis. 

For example, Madras et al. (2018) and Edwards et al. (2015) based their fair representation learning methods on an MSE reconstruction loss. Although they provided insightful and sound analyses on the fairness of the learned representation, they did not embed their reconstruction loss into a theoretical framework. In addition, Huang et al. (2019) and Malekzadeh et al. (2019) targeted similar tasks as ours, but resorted to a heuristic MSE reconstruction loss. On the contrary, in our work we proposed to approach the preservation of the generic features from an information theoretic point of view, and accordingly derived a contrastive learning-based framework. 

Contrastive learning plays a vital role in our design because InfoNCE contrastive learning loss is not only a proper "reconstruction loss", but also a proper approximation to $I(F;X')$ (and $I(X;X')$), which is consistent with our problem definition. Besides, contrastive learning loss does not assume the distribution of $X, X'$. It can be universally applied to images, language, sensor signals, etc, with few adjustments. Another important merit of contrastive learning is its advanced empirical performance. We conducted an ablation experiment where we replaced the contrastive learning loss with MSE reconstruction loss (denoted as MaSS-MSE). The results are shown in Table 1 and Table 2. MaSS-NF means MaSS trained without unannotated useful attributes preservation. We can observe that the NAG (normalized accuracy gain) of digit is significantly lower without unannotated attribute preservation. We can also observe that MaSS achieved higher NAG on digit than MaSS-MSE, as well as lower NAG on other sensitive attributes, which demonstrate the strong empirical performance of contrastive learning loss compared to MSE reconstruction loss.

**Table 1**: Comparison of the classification accuracy and NAG between MaSS and ablations on AudioMNIST. We suppress gender, accent, age, ID, while preserve digit as if an unannotated attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
| No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
| MaSS-NF | 0.8000 (0.0000) | 0.6833 (0.0001) | 0.1658 (0.0000) | 0.0152 (0.0000) | 0.2657 (0.1846) |
| MaSS-MSE | 0.8002 (0.0008) | 0.6833 (0.0001) | 0.1683 (0.0020) | 0.0462 (0.0306) | 0.9542 (0.9517) |
| MaSS | 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0195 (0.0029) | **0.9683 (0.9675)** |

**Table 2**: Comparison of the classification accuracy and NAG between MaSS and ablations on MotionSense.  We suppress gender, ID, while preserve activity as if unannotated useful attribute.

| Method | gender ($\downarrow$) | ID ($\downarrow$) | activity ($\uparrow$) |
|---|---|---|---|
| No suppression| 0.9026 (1.0000) | 0.9817 (1.0000) | 0.9764 (1.0000) |
|Guessing| 0.0533 (0.0000) | 0.5699 (0.0000) | 0.4663 (0.0000) |
| MaSS-NF| 0.0508 (0.0000) | 0.5699 (0.0000) | 0.8374 (0.7275) |
| MaSS-MSE | 0.0754 (0.0260) | 0.5734 (0.0085) | 0.8823 (0.8156) |
| MaSS | 0.0555 (0.0026) | 0.5686 (0.0000) | **0.9242 (0.8977)** |

References:

- Madras, David, et al. "Learning adversarially fair and transferable representations." International Conference on Machine Learning. PMLR, 2018.
- Edwards, Harrison, and Amos Storkey. "Censoring representations with an adversary." arXiv preprint arXiv:1511.05897 (2015).
- Huang, Chong, et al. "Generative adversarial privacy." arXiv preprint arXiv:1807.05306 (2018).
- Malekzadeh, Mohammad, et al. "Mobile sensor data anonymization." Proceedings of the international conference on internet of things design and implementation. 2019.

Reviewer comment (Theory):
The paper proposes learning a data transformation instead of a representation but the codomain of the transformation is another seemingly incidental factor given that interpretability does not appear to be a major concern, based on the narrative and analysis; indeed, in order to compute the contrastive learning objective in a space in which distances are meaningful, the transformed and original samples ultimately have to be embedded in such a representation anyway. The learning of a data transformation instead of a low-dimensional representation leads to a method that is more complicated than seemingly need be, and, moreover, is a design choice that comes at a steep computational cost -- computing all losses in representation space would be much more efficient though there may be some sound theoretical barrier to do doing so.

Author response:
**A2**. This paper is targeted at learning a data transformation instead of a compact representation for the following reasons:

First, transformed data can deliver better **reusability for the community**. For example, users can utilize the transformed data for training generative models. For another case, users can develop their own possibly more generalizable feature extractors on the transformed data. Data reusability is crucial for the proliferation of Machine Learning community. 

Second, transformed data can be readily used by **pre-trained off-the-shelf models**, whereas compact representations can only be used by models specially trained for them. To empirically support this claim, we ran an experiment of facial landmark detection on both the original and the transformed Adience datasets based on torchlm (https://github.com/DefTruth/torchlm), with the PIPNet (Jin et al., 2021) with ResNet18 backbone. This model generates 98 landmarks for each facial image. We then took the landmarks detected from the original images as the ground truth and evaluated the  landmarks detected from the transformed images, using normalized mean error (NME) (Jin et al., 2021) as the quantitative metric. The results are shown in Table 3. We can observe that the NME between the transformed Adience and the original Adience is comparable to the NME between the original WLFW dataset (Wu et al., 2018) and the ground truth label, which suggests that the transformed dataset can be accurately exploited by a pre-trained model. 

**Table 3**: The NME(\%) of PIPNet between transformed Adience and original Adience, in comparison to the NME(\%) of PIPNet between original WLFW dataset and ground truth label. The comparable performance showed that transformed Adience dataset can be accurately exploited by pre-trained PIPNet. On the contrary, compact representations would not be compatible with the pre-trained PIPNet.

| Dataset | WLFW (original vs. label) | Adience (transformed vs. original) |
|---|---|---|
| NME $(\downarrow)$  |3.94|3.30|

References:

- Haibo Jin, Shengcai Liao, and Ling Shao. 2021. Pixel-in-Pixel Net: Towards Efficient Facial Landmark Detection in the Wild. Int. J. Comput. Vision 129, 12 (Dec 2021), 3174–3194. https://doi.org/10.1007/s11263-021-01521-4
- Wayne Wu, Chen Qian, Shuo Yang, Quan Wang, Yici Cai, Qiang Zhou. 2018 CVPR. Look at Boundary: A Boundary-Aware Face Alignment Algorithm

Reviewer comment (Theory):
The mathematical formalism is confusing and, at times, unrigorous. Random variables and their realisations are seemingly conflated without reference to the abuse: mutual information, $\mathcal{I}(\cdot; \cdot)$ is defined between pairs of random variables, not their empirical counterparts. While there is an argument to be made that such overloading is conventional and remedied by the context, I don't think that the latter is entirely satisifed here, especially with their being no express mention of this overloading being adopted throughout the paper.

Author response:
**A3**. We thank the reviewer for pointing out these problems. We adjusted the notations in our revised paper. Specifically, we use uppercase (e.g. $X,F$) for random variables and lowercase (e.g. $x,f$) for their realizations. We also changed the original function name $f$ to $\mathcal{F}$ to correct the notation collision.

Reviewer comment (Theory):
Why compute cross-entropy terms w.r.t. the estimates of $P(U_i|X)$ and $P(S_i|X)$ as opposed to simply using the (degenerate ground-truth distribution (the annotations) used in the fitting of those estimates? There may be good reason for it but there should clear explanation given for why this choice is unprincipled, should that indeed be the case.

Author response:
**A5**. We would like to point out that we did already use this degenerate distribution to compute cross entropy in our original manuscript, as stated in Section 3, Section 4.2 and Section 4.3. We updated the description in the revision for improved clarity.

Reviewer comment (Writing):
The quality of the writing, in terms of clarity and structure, could generally do with improvement.

Author response:
**A6**. We thank the reviewer for the suggestion. We have updated our manuscript to improve its clarity and structure.

Reviewer comment (Experiments):
Lack of ablation studies, such as those investigating the influence of the loss prefactor.

Author response:
**A7**. Apart from the ablation we provided in Table 1 and 2 examining the unannotated attributes preservation module, we also conducted experiments to show the effect of varying the constraint on sensitive attributes suppression ($m$). We took gender, accent, age and ID as sensitive attributes and digit as an annotated useful attribute on the AudioMNIST dataset. We fixed $m=0$ for gender, accent and age and $n=2.3$ for digit (its maximal value). Then we varied $m$ for ID from $0$ to $1.46$ (its maximal value). The results are shown in Table 4. We can observe that as $m$ increases, the constraint is gradually loosened, which results in the gradually increasing accuracy and NAG for ID.

**Table 4**: Varying the suppression constraint $m$ on AudioMNIST. We suppress gender, accent, age, ID, while preserve digit as if an annotated useful attribute.

| Method | gender ($\downarrow$) | accent ($\downarrow$) | age ($\downarrow$) | ID ($\downarrow$) | digit ($\uparrow$) |
|---|---|---|---|---|---|
|No suppression| 0.9962 (1.0000) | 0.9843 (1.0000) | 0.9657 (1.0000) | 0.9808 (1.0000) | 0.9975 (1.0000) |
|Guessing| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.0167 (0.0000) | 0.1000 (0.0000) |
|MaSS $m_{id}$=0.0| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1662 (0.0000) | 0.0183 (0.0017) | 0.9933 (0.9953) |
|MaSS $m_{id}$=0.3| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1665 (0.0000) | 0.0598 (0.0447) | 0.9938 (0.9959) |
|MaSS $m_{id}$=0.6| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1668 (0.0002) | 0.1120 (0.0988) | 0.9940 (0.9961) |
|MaSS $m_{id}$=0.9| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1670 (0.0004) | 0.1493 (0.1376) | 0.9937 (0.9957) |
|MaSS $m_{id}$=1.2| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.1963 (0.1863) | 0.9928 (0.9948) |
|MaSS $m_{id}$=1.46| 0.8000 (0.0000) | 0.6833 (0.0000) | 0.1667 (0.0000) | 0.2597 (0.2520) | 0.9937 (0.9957) |

Reviewer comment (Evaluation):
No discussion of the practical challenges entailed by adversarial infomin (vide Song and Shmatikov, 2021, for instance).

Author response:
**A8**. We thank the reviewer for pointing out this related work. For both de-censoring and re-purposing mentioned in Song et al. (2020), they require the access to the trained black box feature extractor (or, equivalently, the data transformation module in our case). However, the objective of our work is to release the transformed data in order to unleash its utility without the risk of leaking its sensitive attributes, whereas the transformation module itself will not be released. 

Reference: 

- Song, Congzheng, and Vitaly Shmatikov. "Overlearning reveals sensitive attributes." arXiv preprint arXiv:1905.11742 (2019).