Original: L EARNING DATA - DERIVED PRIVACY PRESERVING REPRESENTATIONS FROM INFORMATION METRICS
Revised: L EARNING DATA - DERIVED PRIVACY PRESERVING REPRESENTATIONS FROM INFORMATION METRICS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: It is clear that users should own and control their data and privacy.
Revised: It is clear that users should own and control their data and privacy.

Original: Utility providers are also becoming more interested in guaranteeing data privacy.
Revised: Utility providers are also becoming more interested in guaranteeing data privacy.

Original: Therefore, users and providers can and should collaborate in privacy protecting challenges, and this paper addresses this new paradigm.
Revised: Therefore, users and providers can and should collaborate in privacy protecting challenges, and this paper addresses this new paradigm.

Original: We propose a framework where the user controls what characteristics of the data they wants to share (utility) and what they want to keep private (secret), without necessarily asking the utility provider to change its existing machine learning algorithms.
Revised: We propose a framework where the user controls what characteristics of the data they wants to share (utility) and what they want to keep private (secret), without necessarily asking the utility provider to change its existing machine learning algorithms.

Original: We ﬁrst analyze the space of privacy-preserving representations, and derive natural informationtheoretic bounds on the utility-privacy trade-off when disclosing a sanitized version of the data X .
Revised: We ﬁrst analyze the space of privacy-preserving representations, and derive natural informationtheoretic bounds on the utility-privacy trade-off when disclosing a sanitized version of the data X .

Original: We present explicit learning architectures to learn privacypreserving representations that approach this bound in a data-driven fashion.
Revised: We present explicit learning architectures to learn privacypreserving representations that approach this bound in a data-driven fashion.

Original: We describe important use-case scenarios where the utility providers are willing to collaborate with the sanitization process.
Revised: We describe important use-case scenarios where the utility providers are willing to collaborate with the sanitization process.

Original: We study space-preserving transformations where the utility provider can use the same algorithm on original and sanitized data, a critical and novel attribute to help service providers accommodate varying privacy requirements with a single set of utility algorithms.
Revised: We study space-preserving transformations where the utility provider can use the same algorithm on original and sanitized data, a critical and novel attribute to help service providers accommodate varying privacy requirements with a single set of utility algorithms.

Original: We illustrate this framework through the implementation of three use cases; subject-withinsubject , where we tackle the problem of having a face identity detector that works only on a consenting subset of users, an important application, for example, for mobile devices activated by face recognition; gender-and-subject , where we preserve facial veriﬁcation while hiding the gender attribute for users who choose to do so; and emotion-and-gender , where we hide independent variables, as is the case of hiding gender while preserving emotion detection.
Revised: We illustrate this framework through the implementation of three use cases; subject-withinsubject , where we tackle the problem of having a face identity detector that works only on a consenting subset of users, an important application, for example, for mobile devices activated by face recognition; gender-and-subject , where we preserve facial veriﬁcation while hiding the gender attribute for users who choose to do so; and emotion-and-gender , where we hide independent variables, as is the case of hiding gender while preserving emotion detection.

Original:  I NTRODUCTION , C HALLENGES , AND C ONTRIBUTIONS
Revised:  I NTRODUCTION , C HALLENGES , AND C ONTRIBUTIONS

Original: Individuals are sharing vast amounts of data on a daily basis; at the same time, advances in machine learning mean that service providers that receive this user data can infer increasingly more sensitive attributes about their users.
Revised: Individuals are sharing vast amounts of data on a daily basis; at the same time, advances in machine learning mean that service providers that receive this user data can infer increasingly more sensitive attributes about their users.

Original: Care must be taken to provide an appropriate protection for users in order to adhere to various privacy, legal, and ethical constraints.
Revised: Care must be taken to provide an appropriate protection for users in order to adhere to various privacy, legal, and ethical constraints.

Original: Critical to this is the capability of ﬁnding effective privacy-preserving data representations in a data-driven manner that are able to accommodate each user’s individual needs.
Revised: Critical to this is the capability of ﬁnding effective privacy-preserving data representations in a data-driven manner that are able to accommodate each user’s individual needs.

Original: It is also in the interest of the utility provider to collaborate in this endeavor, the privacy-preserving data representation should account for data processing pipelines already in place.
Revised: It is also in the interest of the utility provider to collaborate in this endeavor, the privacy-preserving data representation should account for data processing pipelines already in place.

Original: It would be impractical to tackle many of the privacy-preserving challenges today using model-based approaches, a data-driven approach is essential in allowing privatization mechanisms to keep up with new applications.
Revised: It would be impractical to tackle many of the privacy-preserving challenges today using model-based approaches, a data-driven approach is essential in allowing privatization mechanisms to keep up with new applications.

Original: Each user should have the ability to deﬁne, sensitive and non-sensitive information associated with their data; we propose that a user and the service provider collaborate towards achieving userspeciﬁc privacy.
Revised: Each user should have the ability to deﬁne, sensitive and non-sensitive information associated with their data; we propose that a user and the service provider collaborate towards achieving userspeciﬁc privacy.

Original: This results in a system where the user sanitizes the data, at the sensing and/or transmitting stage without affecting the utility they need; at the same time, the provider can use the same processing pipeline for both sanitized and non-sanitized data.
Revised: This results in a system where the user sanitizes the data, at the sensing and/or transmitting stage without affecting the utility they need; at the same time, the provider can use the same processing pipeline for both sanitized and non-sanitized data.

Original: This is essential to ensure the service provider can accommodate several privacy requests with a single set of utility algorithms.
Revised: This is essential to ensure the service provider can accommodate several privacy requests with a single set of utility algorithms.

Original: An example addressed by the proposed framework is to block, even at the sensor level, a device from constantly “listening.”
Revised: An example addressed by the proposed framework is to block, even at the sensor level, a device from constantly “listening.”

Original: For example, mobile devices scan images until they detect the owner, and then they open.
Revised: For example, mobile devices scan images until they detect the owner, and then they open.

Original: But all images not from the owner should be private.
Revised: But all images not from the owner should be private.

Original: The proposed framework will make such devices not to understand the data until the visual or sound trigger is detected, with the capability to do this at the sensor level and without modifying the existing recognition system.
Revised: The proposed framework will make such devices not to understand the data until the visual or sound trigger is detected, with the capability to do this at the sensor level and without modifying the existing recognition system.

Original: This new paradigm of collaborative privacy environment is critical since it has also been shown that algorithmic or data augmentation and unpredictable correlations can break privacy Israel et al.
Revised: This new paradigm of collaborative privacy environment is critical since it has also been shown that algorithmic or data augmentation and unpredictable correlations can break privacy Israel et al.

Original: (2014); Narayanan & Shmatikov (2008);
Revised: (2014); Narayanan & Shmatikov (2008);

Original: Oh et al.
Revised: Oh et al.

Original: ; Reuben et al.
Revised: ; Reuben et al.

Original: The impossibility of universal privacy protection has been studied extensively in the domain of differential privacy Dwork (2008), where a number of authors have shown that assumptions about the data or the adversary must be made in order to be able to provide utility Dwork & Naor (2010);
Revised: The impossibility of universal privacy protection has been studied extensively in the domain of differential privacy Dwork (2008), where a number of authors have shown that assumptions about the data or the adversary must be made in order to be able to provide utility Dwork & Naor (2010);

Original: Hardt et al.
Revised: Hardt et al.

Original: ; Kifer &
Revised: ; Kifer &

Original: Machanavajjhala (2011; 2014).
Revised: Machanavajjhala (2011; 2014).

Original: We can, however, minimize the amount of privacy we are willing to sacriﬁce for a given level of utility.
Revised: We can, however, minimize the amount of privacy we are willing to sacriﬁce for a given level of utility.

Original: Other recent data-driven privacy approaches like Wu et al.
Revised: Other recent data-driven privacy approaches like Wu et al.

Original: (2018) have also explored this notion, but do not integrate the additional collaborative constraints.
Revised: (2018) have also explored this notion, but do not integrate the additional collaborative constraints.

Original: Therefore, it is important to design collaborative systems where each user shares a sanitized version of their data with the service provider in such a way that user-deﬁned non-sensitive tasks can be performed but user-deﬁned sensitive ones cannot, without the service provider requiring to change any data processing pipeline otherwise.
Revised: Therefore, it is important to design collaborative systems where each user shares a sanitized version of their data with the service provider in such a way that user-deﬁned non-sensitive tasks can be performed but user-deﬁned sensitive ones cannot, without the service provider requiring to change any data processing pipeline otherwise.

Original: Contributions-
Revised: Contributions-

Original: We consider a scenario where a user wants to share a sanitized representation of data
Revised: We consider a scenario where a user wants to share a sanitized representation of data

Original: X in a way that a latent variable U can be inferred, but a sensitive latent variable S remains hidden.
Revised: X in a way that a latent variable U can be inferred, but a sensitive latent variable S remains hidden.

Original: We formalize this notion using privacy and transparency deﬁnitions.
Revised: We formalize this notion using privacy and transparency deﬁnitions.

Original: We derive an informationtheoretic bound on privacy-preserving representations.
Revised: We derive an informationtheoretic bound on privacy-preserving representations.

Original: The metrics induced by this bound are used to learn such a representation directly from data, without prior knowledge of the joint distribution of the observed data X and the latent variables U and S .
Revised: The metrics induced by this bound are used to learn such a representation directly from data, without prior knowledge of the joint distribution of the observed data X and the latent variables U and S .

Original: This process can accommodate for several user-speciﬁc privacy requirements, and can be modiﬁed to incorporate constraints about the service provider’s existing utility inference algorithms enabling several privacy constraints to be satisﬁed in parallel for a given utility task.
Revised: This process can accommodate for several user-speciﬁc privacy requirements, and can be modiﬁed to incorporate constraints about the service provider’s existing utility inference algorithms enabling several privacy constraints to be satisﬁed in parallel for a given utility task.

Original: We apply this framework to challenging use cases such as hiding gender information from a facial image (a relatively easy task) while preserving subject veriﬁcation (a much harder task), or designing a sanitization function that preserves subject identiﬁcation on a consenting subset of users, while disallowing it on the general population.
Revised: We apply this framework to challenging use cases such as hiding gender information from a facial image (a relatively easy task) while preserving subject veriﬁcation (a much harder task), or designing a sanitization function that preserves subject identiﬁcation on a consenting subset of users, while disallowing it on the general population.

Original: Blocking a simpler task while preserving a harder one and blocking a device from constantly listening out-of-sample data are new applications in this work, here addressed with theoretical foundations and respecting the provider’s existing algorithms, which can simultaneously handle sanitized and non-sanitized data.
Revised: Blocking a simpler task while preserving a harder one and blocking a device from constantly listening out-of-sample data are new applications in this work, here addressed with theoretical foundations and respecting the provider’s existing algorithms, which can simultaneously handle sanitized and non-sanitized data.

Original: The problem statement is detailed in Section 2, and the information-theoretic bounds are derived in Section 3.
Revised: The problem statement is detailed in Section 2, and the information-theoretic bounds are derived in Section 3.

Original: Section 4 deﬁnes a trainable adversarial game that directly attempts to achieve this bound; the section also discusses how service-provider speciﬁc requirements can be incorporated.
Revised: Section 4 deﬁnes a trainable adversarial game that directly attempts to achieve this bound; the section also discusses how service-provider speciﬁc requirements can be incorporated.

Original: Examples of this framework are shown in Section 5.
Revised: Examples of this framework are shown in Section 5.

Original: The paper is concluded in Section 6.
Revised: The paper is concluded in Section 6.

Original: Complementary information and proofs are presented in the Supplementary Material .
Revised: Complementary information and proofs are presented in the Supplementary Material .

Original:  P ROBLEM S TATEMENT
Revised:  P ROBLEM S TATEMENT

Original: We describe a scenario in which we have access to possibly high-dimensional data X ∈ X , this data depends on two special latent variables U and S .
Revised: We describe a scenario in which we have access to possibly high-dimensional data X ∈ X , this data depends on two special latent variables U and S .

Original: U is called the utility latent variable, and is a variable we want to communicate, while S is called the secret, and is a variable we want to protect.
Revised: U is called the utility latent variable, and is a variable we want to communicate, while S is called the secret, and is a variable we want to protect.

Original: We consider two agents, a service provider that wants to estimate U from X , and an actor that wants to infer S from X .
Revised: We consider two agents, a service provider that wants to estimate U from X , and an actor that wants to infer S from X .

Original: We deﬁne a third agent, the privatizer, that wants to learn a space-preserving stochastic mapping
Revised: We deﬁne a third agent, the privatizer, that wants to learn a space-preserving stochastic mapping

Original: Q : X → Q ⊃ X in such a way that Q ( X ) provides information about the latent variable U , but provides relatively little information of S .
Revised: Q : X → Q ⊃ X in such a way that Q ( X ) provides information about the latent variable U , but provides relatively little information of S .

Original: In other words, we want to ﬁnd a data representation that is private with respect to S and transparent with respect to U .
Revised: In other words, we want to ﬁnd a data representation that is private with respect to S and transparent with respect to U .

Original: We ﬁrst recall the deﬁnition of privacy presented in Kifer (2009):
Revised: We ﬁrst recall the deﬁnition of privacy presented in Kifer (2009):

Original: Deﬁnition 2.1.
Revised: Deﬁnition 2.1.

Original: Privacy: Let δ s be a measure of distance between probability distributions, b s ∈ R + a positive real number, and P ( S ) the marginal distribution of the sensitive attribute S .
Revised: Privacy: Let δ s be a measure of distance between probability distributions, b s ∈ R + a positive real number, and P ( S ) the marginal distribution of the sensitive attribute S .

Original: The stochastic mapping Q ( X ) is ( δ s ,
Revised: The stochastic mapping Q ( X ) is ( δ s ,

Original: b s ) -private with respect to S if δ s ( P ( S ) , P ( S | Q ( X ))) <
Revised: b s ) -private with respect to S if δ s ( P ( S ) , P ( S | Q ( X ))) <

Original: b s .
Revised: b s .

Original: We can deﬁne transparency in the same fashion:
Revised: We can deﬁne transparency in the same fashion:

Original: Deﬁnition 2.2.
Revised: Deﬁnition 2.2.

Original: Transparency: Let δ u be a measure of distance between probability distributions, b u ∈ R + a positive real number, and P ( U | X ) the posterior conditional distribution of the utility variable U after observing X .
Revised: Transparency: Let δ u be a measure of distance between probability distributions, b u ∈ R + a positive real number, and P ( U | X ) the posterior conditional distribution of the utility variable U after observing X .

Original: The stochastic mapping Q ( X ) is ( δ u , b u ) -transparent with respect to
Revised: The stochastic mapping Q ( X ) is ( δ u , b u ) -transparent with respect to

Original: U if δ u ( P ( U | X ) , P ( U | Q ( X )))
Revised: U if δ u ( P ( U | X ) , P ( U | Q ( X )))

Original: < b u .
Revised: < b u .

Original: Both deﬁnitions depend on the learned mapping Q ; in the following section, we derive an information-theoretic bound between privacy and transparency, and show that this bound infers a particular choice of metrics δ u , δ s .
Revised: Both deﬁnitions depend on the learned mapping Q ; in the following section, we derive an information-theoretic bound between privacy and transparency, and show that this bound infers a particular choice of metrics δ u , δ s .

Original: We then show that this inferred metric can be directly implemented as a loss function to learn privatization transformations from data using standard machine learning tools.
Revised: We then show that this inferred metric can be directly implemented as a loss function to learn privatization transformations from data using standard machine learning tools.

Original: A similar analysis of these bounds for the special case where we directly observe the utility variable
Revised: A similar analysis of these bounds for the special case where we directly observe the utility variable

Original: U ( X = U ) was analyzed in Calmon et al.
Revised: U ( X = U ) was analyzed in Calmon et al.

Original: (2015) in the context of the Privacy Funnel.
Revised: (2015) in the context of the Privacy Funnel.

Original: Here, we extend this to the more general case where U is observed indirectly.
Revised: Here, we extend this to the more general case where U is observed indirectly.

Original: More importantly, these bounds are used to design a data-driven implementation for learning privacy-preserving mappings.
Revised: More importantly, these bounds are used to design a data-driven implementation for learning privacy-preserving mappings.

Original:  I NFORMATION - THEORETIC BOUNDS ON PRIVACY
Revised:  I NFORMATION - THEORETIC BOUNDS ON PRIVACY

Original: Consider the utility and secret variables U and S deﬁned over discrete alphabets U , S ,and the observed data variable X , deﬁned over X , with joint distribution P X,U,S .
Revised: Consider the utility and secret variables U and S deﬁned over discrete alphabets U , S ,and the observed data variable X , deﬁned over X , with joint distribution P X,U,S .

Original: Figure 1a illustrates this set-up, and shows the fundamental relationship of their entropies H ( · ) and mutual information.
Revised: Figure 1a illustrates this set-up, and shows the fundamental relationship of their entropies H ( · ) and mutual information.

Original: [Figure]
Revised: [Figure]

Original: We analyze the properties of any mapping Q : X → Q , and measure the resulting mutual information between the transformed variable Q ( X ) and our quantities of interest.
Revised: We analyze the properties of any mapping Q : X → Q , and measure the resulting mutual information between the transformed variable Q ( X ) and our quantities of interest.

Original: Our goal is to ﬁnd Q such that the information leakage from our sanitized data I ( S ; Q ( X )) is minimized, while maximizing the shared information of the utility variable
Revised: Our goal is to ﬁnd Q such that the information leakage from our sanitized data I ( S ; Q ( X )) is minimized, while maximizing the shared information of the utility variable

Original: I ( U ; Q ( X )) .
Revised: I ( U ; Q ( X )) .

Original: We will later relate these quantities and the bounds here developed with the privacy/utility deﬁnitions presented in the previous section.
Revised: We will later relate these quantities and the bounds here developed with the privacy/utility deﬁnitions presented in the previous section.

Original: Maximizing I ( U ; Q ( X )) is equivalent to minimizing I ( U ; X | Q ( X )) , since I ( U ; X | Q ( X )) =
Revised: Maximizing I ( U ; Q ( X )) is equivalent to minimizing I ( U ; X | Q ( X )) , since I ( U ; X | Q ( X )) =

Original: I ( U ; X ) − I ( U ; Q ( X )) .
Revised: I ( U ; X ) − I ( U ; Q ( X )) .

Original: The quantity I ( U ; X | Q ( X )) is the information X contains about U that is censured by the sanitization mapping Q .
Revised: The quantity I ( U ; X | Q ( X )) is the information X contains about U that is censured by the sanitization mapping Q .

Original: Figure 1b illustrates I ( S ; Q ( X )) and I ( U ; X | Q ( X )) .
Revised: Figure 1b illustrates I ( S ; Q ( X )) and I ( U ; X | Q ( X )) .

Original: One can see that there exists a trade-off area,
Revised: One can see that there exists a trade-off area,

Original: I ( U, S ) − I ( U, S | X ) , that is always included in the union of I ( S ; Q ( X )) and
Revised: I ( U, S ) − I ( U, S | X ) , that is always included in the union of I ( S ; Q ( X )) and

Original: I ( U ; X | Q ( X )) .
Revised: I ( U ; X | Q ( X )) .

Original: The lower we make I ( S ; Q ( X )) , the higher we make the censored information
Revised: The lower we make I ( S ; Q ( X )) , the higher we make the censored information

Original: I ( U ; X | Q ( X )) , and vice versa.
Revised: I ( U ; X | Q ( X )) , and vice versa.

Original: This induces a lower bound over the performance of the best possible mappings Q ( X ) that is formalized in the following lemma.
Revised: This induces a lower bound over the performance of the best possible mappings Q ( X ) that is formalized in the following lemma.

Original: Lemma 3.1 .
Revised: Lemma 3.1 .

Original: Let X, U, S be three discrete random variables with joint probability distribution
Revised: Let X, U, S be three discrete random variables with joint probability distribution

Original: P X,U,S .
Revised: P X,U,S .

Original: For any stochastic mapping Q : X → Q we have
Revised: For any stochastic mapping Q : X → Q we have

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Proof of this lemma is shown in Supplementary Material.
Revised: Proof of this lemma is shown in Supplementary Material.

Original: To show that this bound is reachable in some instances, consider the following example.
Revised: To show that this bound is reachable in some instances, consider the following example.

Original: Let U and S be independent discrete random variables, and
Revised: Let U and S be independent discrete random variables, and

Original: X =
Revised: X =

Original: ( U, S ) .
Revised: ( U, S ) .

Original: The sanitization mapping Q ( X ) =
Revised: The sanitization mapping Q ( X ) =

Original: U satisﬁes this bound with equality.
Revised: U satisﬁes this bound with equality.

Original: We can also prove, trivially, an upper bound for these quantities.
Revised: We can also prove, trivially, an upper bound for these quantities.

Original: Lemma 3.2 .
Revised: Lemma 3.2 .

Original: Let X, U, S be three discrete random variables with joint probability distribution
Revised: Let X, U, S be three discrete random variables with joint probability distribution

Original: P X,U,S .
Revised: P X,U,S .

Original: For any stochastic mapping Q : X → Q we have:
Revised: For any stochastic mapping Q : X → Q we have:

Original: [Equation]
Revised: [Equation]

Original: That simply states that the information leakage about the secret and the censured information on the utility variable cannot exceed the total information present in the original observed variable X .
Revised: That simply states that the information leakage about the secret and the censured information on the utility variable cannot exceed the total information present in the original observed variable X .

Original: 3. R ELATION W ITH P RIVACY A ND T RANSPARENCY M ETRICS
Revised: 3. R ELATION W ITH P RIVACY A ND T RANSPARENCY M ETRICS

Original: We relate the terms
Revised: We relate the terms

Original: I ( S ; Q ( X )) and I ( U ; X | Q ( X )) in Eq.1 back to our deﬁnitions of privacy and transparency.
Revised: I ( S ; Q ( X )) and I ( U ; X | Q ( X )) in Eq.1 back to our deﬁnitions of privacy and transparency.

Original: [Equation]
Revised: [Equation]

Original: Here we used the fact that U is conditionally independent of Q given X .
Revised: Here we used the fact that U is conditionally independent of Q given X .

Original: We then observe that Eq.
Revised: We then observe that Eq.

Original: 3 induces the Kullback-Leibler divergence D KL as a natural transparency metric δ u in Def.2.2.
Revised: 3 induces the Kullback-Leibler divergence D KL as a natural transparency metric δ u in Def.2.2.

Original: Similarly, we can analyze I
Revised: Similarly, we can analyze I

Original: [Equation]
Revised: [Equation]

Original: S ; Q ) to get,
Revised: S ; Q ) to get,

Original: [Equation]
Revised: [Equation]

Original: We can see from Eq.4 that the natural induced metric for measuring privacy δ s in Def,2.1 is the reverse Kullback-Leibler divergence RD KL .
Revised: We can see from Eq.4 that the natural induced metric for measuring privacy δ s in Def,2.1 is the reverse Kullback-Leibler divergence RD KL .

Original: We can thus rewrite our fundamental tradeoff equation as
Revised: We can thus rewrite our fundamental tradeoff equation as

Original: [Equation]
Revised: [Equation]

Original: We show next how this bound can be used to deﬁne a trainable loss metric, allowing the privatizer to select different points in the transparency-privacy trade-off space.
Revised: We show next how this bound can be used to deﬁne a trainable loss metric, allowing the privatizer to select different points in the transparency-privacy trade-off space.

Original: 3. D EFINING A TRAINABLE LOSS METRIC
Revised: 3. D EFINING A TRAINABLE LOSS METRIC

Original: Assume that for any given stochastic transformation mapping Q ∼ Q ( X ) , we have access to the posterior conditional probability distributions P ( S | Q ) , P ( U | Q ) , and P ( U | X ) .
Revised: Assume that for any given stochastic transformation mapping Q ∼ Q ( X ) , we have access to the posterior conditional probability distributions P ( S | Q ) , P ( U | Q ) , and P ( U | X ) .

Original: Assume we also have access to the prior distribution of P ( S ) .
Revised: Assume we also have access to the prior distribution of P ( S ) .

Original: Inspired by the bounds from the previous section, the proposed privatizer loss is
Revised: Inspired by the bounds from the previous section, the proposed privatizer loss is

Original: [Equation]
Revised: [Equation]

Original: where α ∈ [0 , 1] is a tradeoff constant.
Revised: where α ∈ [0 , 1] is a tradeoff constant.

Original: A low α value implies a high degree of transparency, while a high value of α implies a high degree of privacy.
Revised: A low α value implies a high degree of transparency, while a high value of α implies a high degree of privacy.

Original: Using Eq.5 we have a lower bound on how private or transparent the privatizer can be for any given α value, as detailed next.
Revised: Using Eq.5 we have a lower bound on how private or transparent the privatizer can be for any given α value, as detailed next.

Original: Theorem 3.3.
Revised: Theorem 3.3.

Original: For any α ∈ [0 , 1] , and stochastic mapping Q : X → Q the solution to Eq.
Revised: For any α ∈ [0 , 1] , and stochastic mapping Q : X → Q the solution to Eq.

Original: guarantees the following bounds,
Revised: guarantees the following bounds,

Original: [Equation]
Revised: [Equation]

Original: The proof is shown in Supplementary Material.
Revised: The proof is shown in Supplementary Material.

Original: To recap, we proposed a privatizer loss Eq.6 with a controllable trade-off parameter α , and showed bounds on how transparent and private our data can be for any given value of α .
Revised: To recap, we proposed a privatizer loss Eq.6 with a controllable trade-off parameter α , and showed bounds on how transparent and private our data can be for any given value of α .

Original: Next we show how to optimize this utility-privacy formulation.
Revised: Next we show how to optimize this utility-privacy formulation.

Original:  A D ATA -D RIVEN IMPLEMENTATION
Revised:  A D ATA -D RIVEN IMPLEMENTATION

Original: Even if the joint distribution of P ( U, S, X ) is not known, the privatizer can attempt to directly implement Eq.6 in a data-driven architecture to ﬁnd the optimal Q .
Revised: Even if the joint distribution of P ( U, S, X ) is not known, the privatizer can attempt to directly implement Eq.6 in a data-driven architecture to ﬁnd the optimal Q .

Original: Assume the privatizer has access to a dataset { ( x, s, u ) } , where s and u are the ground truth secret and utility values of observation x .
Revised: Assume the privatizer has access to a dataset { ( x, s, u ) } , where s and u are the ground truth secret and utility values of observation x .

Original: Under these conditions, the privatizer searches for a parametric mapping q = Q θ ( x, z ) , where z is an independent random variable, and attempts to predict the best possible attack by learning
Revised: Under these conditions, the privatizer searches for a parametric mapping q = Q θ ( x, z ) , where z is an independent random variable, and attempts to predict the best possible attack by learning

Original: P η ( s | q ) , an estimator of P ( s | q ) .
Revised: P η ( s | q ) , an estimator of P ( s | q ) .

Original: The privatizer also needs P ψ ( u | q ) and P φ ( u | x ) , estimators of
Revised: The privatizer also needs P ψ ( u | q ) and P φ ( u | x ) , estimators of

Original: P ( u | q ) and P ( u | x ) respectively, to measure how much information about the utility variable is censored with the proposed mapping.
Revised: P ( u | q ) and P ( u | x ) respectively, to measure how much information about the utility variable is censored with the proposed mapping.

Original: Under this setup Q θ ( x, z ) is obtained by optimizing the following adversarial game:
Revised: Under this setup Q θ ( x, z ) is obtained by optimizing the following adversarial game:

Original: [Equation]
Revised: [Equation]

Original: Here the ﬁrst three terms are crossentropy loss terms to ensure our estimators
Revised: Here the ﬁrst three terms are crossentropy loss terms to ensure our estimators

Original: P η ( s | q ) , P ψ ( u | q ) , and
Revised: P η ( s | q ) , P ψ ( u | q ) , and

Original: P φ ( u | x ) are a good approximation to the true posterior distributions.
Revised: P φ ( u | x ) are a good approximation to the true posterior distributions.

Original: The ﬁnal loss term attempts to ﬁnd the best possible sampling function Q θ ( x, z ) such that (1 − α )
Revised: The ﬁnal loss term attempts to ﬁnd the best possible sampling function Q θ ( x, z ) such that (1 − α )

Original: I 2 ( U ; X | Q ) + αI 2 ( S ; Q ) is minimized.
Revised: I 2 ( U ; X | Q ) + αI 2 ( S ; Q ) is minimized.

Original: Details on the algorithmic implementation are given in Section 7.3.1.
Revised: Details on the algorithmic implementation are given in Section 7.3.1.

Original: Performance on simulated datasets is shown in Section 7.2.
Revised: Performance on simulated datasets is shown in Section 7.2.

Original: 4. P RIVACY U NDER F IXED U TILITY I NFERENCE
Revised: 4. P RIVACY U NDER F IXED U TILITY I NFERENCE

Original: The proposed framework naturally provides a means to achieve collaboration from the utility provider.
Revised: The proposed framework naturally provides a means to achieve collaboration from the utility provider.

Original: In this scenario, the utility provider wishes to respect the user’s desired privacy, but is unwilling to change their estimation
Revised: In this scenario, the utility provider wishes to respect the user’s desired privacy, but is unwilling to change their estimation

Original: algorithm P
Revised: algorithm P

Original: ˆ φ ( u | x ) , and expects the privatizer to ﬁnd a mapping that minimally affects its current performance.
Revised: ˆ φ ( u | x ) , and expects the privatizer to ﬁnd a mapping that minimally affects its current performance.

Original: 2 This is a more challenging scenario, with worse tradeoff characteristics, in which Q θ ( x, z ) is obtained by optimizing
Revised: 2 This is a more challenging scenario, with worse tradeoff characteristics, in which Q θ ( x, z ) is obtained by optimizing

Original: [Equation]
Revised: [Equation]

Original: 4. P RIVACY U NDER F IXED U TILITY AND S ECRET I NFERENCE
Revised: 4. P RIVACY U NDER F IXED U TILITY AND S ECRET I NFERENCE

Original: A ﬁnal scenario addressed by the proposed framework arises when the utility provider is the sole agent to access the sanitized data, and it has estimation algorithms for both the utility and the privacy variable P ˆ φ ( u | x ) , P ˆ η ( s | x ) , that it is unwilling to modify.
Revised: A ﬁnal scenario addressed by the proposed framework arises when the utility provider is the sole agent to access the sanitized data, and it has estimation algorithms for both the utility and the privacy variable P ˆ φ ( u | x ) , P ˆ η ( s | x ) , that it is unwilling to modify.

Original: The service provider wishes to reassure the users that they are unable to infer the secret attribute from the sanitized data, if and when the user decides so.
Revised: The service provider wishes to reassure the users that they are unable to infer the secret attribute from the sanitized data, if and when the user decides so.

Original: Under these conditions, we optimize for
Revised: Under these conditions, we optimize for

Original: [Equation]
Revised: [Equation]

Original:  E XPERIMENTS AND R ESULTS
Revised:  E XPERIMENTS AND R ESULTS

Original: The following examples are based on the framework presented in Figure 2.
Revised: The following examples are based on the framework presented in Figure 2.

Original: Here we have the three key agents mentioned before: (1) the utility algorithm that is used by the provider to estimate the information of interest.
Revised: Here we have the three key agents mentioned before: (1) the utility algorithm that is used by the provider to estimate the information of interest.

Original: This algorithm can take the raw data ( X ) or the mapped data ( Q ( X ) ) and be able to infer the utility; (2) the secret algorithm that is able to operate on the mapped data to infer the secret; (3) the privatizer that learns a space preserving mapping Q that allows the provider to learn the utility but prevents the secret algorithm to infer the secret.
Revised: This algorithm can take the raw data ( X ) or the mapped data ( Q ( X ) ) and be able to infer the utility; (2) the secret algorithm that is able to operate on the mapped data to infer the secret; (3) the privatizer that learns a space preserving mapping Q that allows the provider to learn the utility but prevents the secret algorithm to infer the secret.

Original: The utility algorithm is trained to perform well on raw data, the secret algorithm is adversarially trained to infer the secret variable after sanitization.
Revised: The utility algorithm is trained to perform well on raw data, the secret algorithm is adversarially trained to infer the secret variable after sanitization.

Original: In the next examples we show how the proposed framework performs under different scenarios, the privatizer architecture is kept unchanged across all experiments to show that the same architecture can achieve very different objectives using the proposed framework, the detailed architectures are shown in Section 7.3.2.
Revised: In the next examples we show how the proposed framework performs under different scenarios, the privatizer architecture is kept unchanged across all experiments to show that the same architecture can achieve very different objectives using the proposed framework, the detailed architectures are shown in Section 7.3.2.

Original: Extra experiments under known conditions are shown in 7.2.
Revised: Extra experiments under known conditions are shown in 7.2.

Original: Raw data can be directly fed into the secret and utility inferring algorithm.
Revised: Raw data can be directly fed into the secret and utility inferring algorithm.

Original: Since the privatization mapping is space pre- serving, the privatized data can also be directly fed to both tasks without any need for further adaptations.
Revised: Since the privatization mapping is space pre- serving, the privatized data can also be directly fed to both tasks without any need for further adaptations.

Original: 5. S UBJECT W ITHIN S UBJECT
Revised: 5. S UBJECT W ITHIN S UBJECT

Original: We begin by analyzing the subject-within-subject problem.
Revised: We begin by analyzing the subject-within-subject problem.

Original: Imagine a subset of users wish to unlock their phone using facial identiﬁcation, while others opt out of the feature; we wish the face identiﬁcation service to work only on the consenting subset of users.
Revised: Imagine a subset of users wish to unlock their phone using facial identiﬁcation, while others opt out of the feature; we wish the face identiﬁcation service to work only on the consenting subset of users.

Original: We additionally assume that the utility provider wishes to comply with the user’s wishes, so we can apply the framework described in Section 4.2.
Revised: We additionally assume that the utility provider wishes to comply with the user’s wishes, so we can apply the framework described in Section 4.2.

Original: Note that in this problem, the utility and secrecy variables are mutually exclusive.
Revised: Note that in this problem, the utility and secrecy variables are mutually exclusive.

Original: We solve this problem by training a space-preserving stochastic mapping Q on facial image data
Revised: We solve this problem by training a space-preserving stochastic mapping Q on facial image data

Original: X , where the utility and secret variable U and S are categorical variables over consenting and nonconsenting users respectively.
Revised: X , where the utility and secret variable U and S are categorical variables over consenting and nonconsenting users respectively.

Original: We test this over the FaceScrub dataset Kemelmacher-Shlizerman et al.
Revised: We test this over the FaceScrub dataset Kemelmacher-Shlizerman et al.

Original: (2016), using VGGFace2 Cao et al.
Revised: (2016), using VGGFace2 Cao et al.

Original: (2017) as the utility and secrecy inferring algorithm.
Revised: (2017) as the utility and secrecy inferring algorithm.

Original: The stochastic mapping was implemented using a stochastic adaptation of the UNET Ronneberger et al.
Revised: The stochastic mapping was implemented using a stochastic adaptation of the UNET Ronneberger et al.

Original: (2015), architecture details are provided in Section 7.3.2.
Revised: (2015), architecture details are provided in Section 7.3.2.

Original: Table 1 shows the top-5 categorical accuracy of the utility network over the sanitized data at various α points in the privacy-utility trade-off.
Revised: Table 1 shows the top-5 categorical accuracy of the utility network over the sanitized data at various α points in the privacy-utility trade-off.

Original: Figure 3 show some representantive images on how images are sanitized.
Revised: Figure 3 show some representantive images on how images are sanitized.

Original: It also shows that the sanitization function is able to preserve information about the utility variable while effectively censoring the secret variable, even for unobserved images.
Revised: It also shows that the sanitization function is able to preserve information about the utility variable while effectively censoring the secret variable, even for unobserved images.

Original: A phone equipped with this ﬁlter at the sensor level would be effectively incapable of collecting information on nonconsenting users.
Revised: A phone equipped with this ﬁlter at the sensor level would be effectively incapable of collecting information on nonconsenting users.

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: 5. O BFUSCATING E MOTION W HILE P RESERVING G ENDER
Revised: 5. O BFUSCATING E MOTION W HILE P RESERVING G ENDER

Original: Here we continue to work on facial image data X , where utility variable U is gender recognition, and the secret variable S is emotion (smiling/non-smiling).
Revised: Here we continue to work on facial image data X , where utility variable U is gender recognition, and the secret variable S is emotion (smiling/non-smiling).

Original: In this scenario, variables U and S are independent.
Revised: In this scenario, variables U and S are independent.

Original: We implement this over the CelebA dataset Liu et al.
Revised: We implement this over the CelebA dataset Liu et al.

Original: (2015) using Xception networks
Revised: (2015) using Xception networks

Original: Chollet (2017) as our utility and privacy estimators.
Revised: Chollet (2017) as our utility and privacy estimators.

Original: Table.2 shows the distribution of the utility and secrecy estimators over the sanitized data.
Revised: Table.2 shows the distribution of the utility and secrecy estimators over the sanitized data.

Original: Figure 4 shows example sanitized images.
Revised: Figure 4 shows example sanitized images.

Original: It is visually possible to identify the gender of the subject but not their emotion.
Revised: It is visually possible to identify the gender of the subject but not their emotion.

Original: Most importantly, the existing gender detection algorithm still performs correctly over the sanitized images.
Revised: Most importantly, the existing gender detection algorithm still performs correctly over the sanitized images.

Original: [Table]
Revised: [Table]

Original: 5. S UBJECT PRESERVATION AND GENDER OBFUSCATION
Revised: 5. S UBJECT PRESERVATION AND GENDER OBFUSCATION

Original: In this setup, we want to ﬁnd a mapping Q that hides the gender attribute but allows subject veriﬁcation.
Revised: In this setup, we want to ﬁnd a mapping Q that hides the gender attribute but allows subject veriﬁcation.

Original: The mapping Q should prevent a standard gender detection algorithm from performing its task, while allowing a standard subject detector algorithm to still perform subject veriﬁcation.
Revised: The mapping Q should prevent a standard gender detection algorithm from performing its task, while allowing a standard subject detector algorithm to still perform subject veriﬁcation.

Original: This is the only experiment in this section where the secret inference algorithm is ﬁxed.
Revised: This is the only experiment in this section where the secret inference algorithm is ﬁxed.

Original: To realize this constrained scenario, we used a WideResNet-based Zagoruyko & Komodakis (2016) implementation of DEXNet Rothe et al.
Revised: To realize this constrained scenario, we used a WideResNet-based Zagoruyko & Komodakis (2016) implementation of DEXNet Rothe et al.

Original: as our gender detector adversary, and a ResNet50 implementation of VGGface2 Cao et al.
Revised: as our gender detector adversary, and a ResNet50 implementation of VGGface2 Cao et al.

Original: (2017) as a subject identiﬁer.
Revised: (2017) as a subject identiﬁer.

Original: The stochastic mapping was implemented using two differing architectures, the ﬁrst is a stochastic adaptation of the UNET
Revised: The stochastic mapping was implemented using two differing architectures, the ﬁrst is a stochastic adaptation of the UNET

Original: Ronneberger et al. (2015), and the second a concatenation of a FaderNet Lample et al.
Revised: Ronneberger et al. (2015), and the second a concatenation of a FaderNet Lample et al.

Original: (2017) and a
Revised: (2017) and a

Original: UNET Ronneberger et al.
Revised: UNET Ronneberger et al.

Original: (2015) as shown in Bertran et al.
Revised: (2015) as shown in Bertran et al.

Original: The mapping that incorporates a pretrained FaderNet was chosen as the baseline for the stochastic mapping function since this network is already trained to defeat a gender discriminator in its encoding space .
Revised: The mapping that incorporates a pretrained FaderNet was chosen as the baseline for the stochastic mapping function since this network is already trained to defeat a gender discriminator in its encoding space .

Original: This proves a suitable baseline comparison and starting point for a mapping function that needs to fool a gender discriminator in image space while simultaneously preserving subject veriﬁcation performance.
Revised: This proves a suitable baseline comparison and starting point for a mapping function that needs to fool a gender discriminator in image space while simultaneously preserving subject veriﬁcation performance.

Original: We show the performance of using only the pretrained gender FaderNet and demonstrate how we can improve its performance by training a posterior processing mapping (UNET) using the loss proposed in Eq.10.
Revised: We show the performance of using only the pretrained gender FaderNet and demonstrate how we can improve its performance by training a posterior processing mapping (UNET) using the loss proposed in Eq.10.

Original: We tested this framework on the FaceScrub dataset Ng & Winkler (2014).
Revised: We tested this framework on the FaceScrub dataset Ng & Winkler (2014).

Original: Figure 5 shows how the output probabilities of the gender classiﬁcation model approach the prior distribution of the dataset as α increases.
Revised: Figure 5 shows how the output probabilities of the gender classiﬁcation model approach the prior distribution of the dataset as α increases.

Original: We see that sanitized images produce output gender probabilities close to the dataset prior even for relatively low α values.
Revised: We see that sanitized images produce output gender probabilities close to the dataset prior even for relatively low α values.

Original: Last column of ﬁgure 5 shows how the top-5 categorical accuracy of the subject veriﬁcation task varies across different α values.
Revised: Last column of ﬁgure 5 shows how the top-5 categorical accuracy of the subject veriﬁcation task varies across different α values.

Original: These results suggest that under these conditions we can achieve almost perfect privacy while maintaining reasonable utility performance.
Revised: These results suggest that under these conditions we can achieve almost perfect privacy while maintaining reasonable utility performance.

Original: [Figure]
Revised: [Figure]

Original:  C ONCLUDING R EMARKS
Revised:  C ONCLUDING R EMARKS

Original: Inspired by information-theory bounds on the privacy-utility trade-off, we introduced a new paradigm where users and entities collaborate to achieve both utility and privacy per a user’s speciﬁc requirements.
Revised: Inspired by information-theory bounds on the privacy-utility trade-off, we introduced a new paradigm where users and entities collaborate to achieve both utility and privacy per a user’s speciﬁc requirements.

Original: One salient feature of this paradigm is that it can be completely transparent – involving only the use of a simple user-speciﬁc privacy ﬁlter applied to user data – in the sense that it requires otherwise no modiﬁcations to the system infrastructure, including the service provider algorithmic capability, in order to achieve both utility and privacy.
Revised: One salient feature of this paradigm is that it can be completely transparent – involving only the use of a simple user-speciﬁc privacy ﬁlter applied to user data – in the sense that it requires otherwise no modiﬁcations to the system infrastructure, including the service provider algorithmic capability, in order to achieve both utility and privacy.

Original: Representative architectures and results suggest that a collaborative user-controlled privacy approach can be achieved.
Revised: Representative architectures and results suggest that a collaborative user-controlled privacy approach can be achieved.

Original: While the results here presented clearly show the potential of this approach, much has yet to be done, of particular note is extending this approach to continuous utility and privacy variables.
Revised: While the results here presented clearly show the potential of this approach, much has yet to be done, of particular note is extending this approach to continuous utility and privacy variables.

Original: While the underlying framework still holds, reliably measuring information between continuous variables is a more challenging task to perform and optimize for.
Revised: While the underlying framework still holds, reliably measuring information between continuous variables is a more challenging task to perform and optimize for.

Original: The proposed framework provides privacy metrics and bounds in expectation; we are currently investigating how the privacy tails concentrate as data is acquired and if there is a need to use information theory metrics with worst-case scenario guarantees.
Revised: The proposed framework provides privacy metrics and bounds in expectation; we are currently investigating how the privacy tails concentrate as data is acquired and if there is a need to use information theory metrics with worst-case scenario guarantees.

Original: Modifying the information theory metrics to match some of the theoretical results in (local) differential privacy is also the subject of future research.
Revised: Modifying the information theory metrics to match some of the theoretical results in (local) differential privacy is also the subject of future research.

Original: Privacy is closely related to fairness, transparency, and explainability, both in goals and in some of the underlying mathematics.
Revised: Privacy is closely related to fairness, transparency, and explainability, both in goals and in some of the underlying mathematics.

Original: A uniﬁed theory of these topics will be a great contribution to the ML community.
Revised: A uniﬁed theory of these topics will be a great contribution to the ML community.

Original:  S UPPLEMENTARY M ATERIAL 7. P ROOFS Proof. Lemma
Revised:  S UPPLEMENTARY M ATERIAL 7. P ROOFS Proof. Lemma

Original: Consider the equality
Revised: Consider the equality

Original: [Equation]
Revised: [Equation]

Original: We know that
Revised: We know that

Original: [Equation]
Revised: [Equation]

Original: so we can guarantee
Revised: so we can guarantee

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: Theorem 3.
Revised: Theorem 3.

Original: Consider
Revised: Consider

Original: [Equation]
Revised: [Equation]

Original: and α ∈ [0 , 1] .
Revised: and α ∈ [0 , 1] .

Original: Minimizing Eq.6 respecting Eq.5 and Eq.12 is equivalent to solving:
Revised: Minimizing Eq.6 respecting Eq.5 and Eq.12 is equivalent to solving:

Original: [Equation]
Revised: [Equation]

Original: Consider the following relaxation of Eq.
Revised: Consider the following relaxation of Eq.

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where A and B are positive real values.
Revised: where A and B are positive real values.

Original: Eq.16 is a relaxation of Eq.15 because the space of possible tuples ( A Q , B Q ) is included in the space of possible values of R 2+
Revised: Eq.16 is a relaxation of Eq.15 because the space of possible tuples ( A Q , B Q ) is included in the space of possible values of R 2+

Original: Suppose Q ∗ is the solution to Eq.15, with corresponding values ( A Q ∗ , B Q ∗ ) , and suppose ( A ∗ , B ∗ ) is the solution to Eq.
Revised: Suppose Q ∗ is the solution to Eq.15, with corresponding values ( A Q ∗ , B Q ∗ ) , and suppose ( A ∗ , B ∗ ) is the solution to Eq.

Original: We know
Revised: We know

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Assume A ∗ > A Q ∗ , it follows that (1 − α )
Revised: Assume A ∗ > A Q ∗ , it follows that (1 − α )

Original: A Q ∗ + αB ∗ 2 ≤ (1 − α
Revised: A Q ∗ + αB ∗ 2 ≤ (1 − α

Original: [Equation]
Revised: [Equation]

Original: A ∗ 2 + αB ∗ 2 .
Revised: A ∗ 2 + αB ∗ 2 .

Original: However, A Q ∗ > 0 and A Q ∗ + B ∗ ≤ A ∗ + B ∗ ≤ K .
Revised: However, A Q ∗ > 0 and A Q ∗ + B ∗ ≤ A ∗ + B ∗ ≤ K .

Original: Therefore, ( A Q ∗ , B ∗ ) is a valid solution to
Revised: Therefore, ( A Q ∗ , B ∗ ) is a valid solution to

Original: Eq.16, and is smaller than the lower bound ( A ∗ , B ∗ ) .
Revised: Eq.16, and is smaller than the lower bound ( A ∗ , B ∗ ) .

Original: This contradiction arises from assuming A ∗ > A Q ∗ , we thus conclude that
Revised: This contradiction arises from assuming A ∗ > A Q ∗ , we thus conclude that

Original: [Equation]
Revised: [Equation]

Original: Similarly for B ∗ and B Q ∗ we get
Revised: Similarly for B ∗ and B Q ∗ we get

Original: [Equation]
Revised: [Equation]

Original: Additionally, Eq.16 is easily solvable and has solutions
Revised: Additionally, Eq.16 is easily solvable and has solutions

Original: [Equation]
Revised: [Equation]

Original: Consequently, we proved
Revised: Consequently, we proved

Original: [Equation]
Revised: [Equation]

Original: 7. E XPERIMENTS ON SIMULATED DATA
Revised: 7. E XPERIMENTS ON SIMULATED DATA

Original: The following experiments attempt to show how close to the theoretical bound shown in Eq.
Revised: The following experiments attempt to show how close to the theoretical bound shown in Eq.

Original: 5 we can get by following Algorithm 1 under known conditions.
Revised: 5 we can get by following Algorithm 1 under known conditions.

Original: Consider the following scenario:
Revised: Consider the following scenario:

Original: Utility variable U and secret variable S are two Bernoulli variables with the following joint distribution:
Revised: Utility variable U and secret variable S are two Bernoulli variables with the following joint distribution:

Original: [Equation]
Revised: [Equation]

Original: where the marginal probabilities are P ( U = 1)
Revised: where the marginal probabilities are P ( U = 1)

Original: = ρ , P ( S = 1) = β , and k is a parameter that controls the dependence between and S , k ∈ [0 , min { ρ − 1 , β − 1 } ] .
Revised: = ρ , P ( S = 1) = β , and k is a parameter that controls the dependence between and S , k ∈ [0 , min { ρ − 1 , β − 1 } ] .

Original: For these experiments, we make both marginals equal to 0 .
Revised: For these experiments, we make both marginals equal to 0 .

Original: 5 ( ρ = β = 0 . 5 ).
Revised: 5 ( ρ = β = 0 . 5 ).

Original: Note that when k = 1 ,
Revised: Note that when k = 1 ,

Original: U and S are independent ( I ( U ; S ) = 0 ) and when k = 0 or k = 2 they reach maximum mutual information ( I ( U ; S )
Revised: U and S are independent ( I ( U ; S ) = 0 ) and when k = 0 or k = 2 they reach maximum mutual information ( I ( U ; S )

Original: =
Revised: =

Original: H ( U ) =
Revised: H ( U ) =

Original: H ( S ) =
Revised: H ( S ) =

Original: H b (0 . 5) =
Revised: H b (0 . 5) =

Original: ln (1) nats).
Revised: ln (1) nats).

Original: Our observations X will be taken in the extreme case, where X contains almost perfect information about the values of U and S .
Revised: Our observations X will be taken in the extreme case, where X contains almost perfect information about the values of U and S .

Original: We do this by assuming that X ∈ R 2 is a Gaussian Mixture Model X with the following conditional distribution:
Revised: We do this by assuming that X ∈ R 2 is a Gaussian Mixture Model X with the following conditional distribution:

Original: [Equation]
Revised: [Equation]

Original: We choose a low σ = 0 .
Revised: We choose a low σ = 0 .

Original: 05 ; this makes it so that every pair ( u, s ) is mapped to almost entirely disjoint regions, therefore knowing X gives nearly perfect information about ( u, s )
Revised: 05 ; this makes it so that every pair ( u, s ) is mapped to almost entirely disjoint regions, therefore knowing X gives nearly perfect information about ( u, s )

Original: ( I ( U ; X ) (cid:39)
Revised: ( I ( U ; X ) (cid:39)

Original: H ( U ) , I ( S ; X ) (cid:39) H ( S ) , I ( U ; S | X ) (cid:39) 0 ).
Revised: H ( U ) , I ( S ; X ) (cid:39) H ( S ) , I ( U ; S | X ) (cid:39) 0 ).

Original: For added simplicity, the privacy ﬁlter is linear:
Revised: For added simplicity, the privacy ﬁlter is linear:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Figure]
Revised: [Figure]

Original: Figure 6 shows how the raw and sanitized data are distributed for varying levels of codependence k and tradeoff α for linear sanitization functions.
Revised: Figure 6 shows how the raw and sanitized data are distributed for varying levels of codependence k and tradeoff α for linear sanitization functions.

Original: Figure 7 shows that privacy ﬁlters optimized using Algorithm 1 learn effective privacy-preserving mappings close to the theoretical bounds, even for a simple ﬁltering architecture.
Revised: Figure 7 shows that privacy ﬁlters optimized using Algorithm 1 learn effective privacy-preserving mappings close to the theoretical bounds, even for a simple ﬁltering architecture.

Original: They do so without any explicit modelling of the underlying data-generating distributions, and we can achieve different tradeoff points by simply modiﬁng the parameter α .
Revised: They do so without any explicit modelling of the underlying data-generating distributions, and we can achieve different tradeoff points by simply modiﬁng the parameter α .

Original: Note that when variables U and S are perfectly independent or codependent, the linear ﬁlter is perfectly able to reach any point in the optimal bound.
Revised: Note that when variables U and S are perfectly independent or codependent, the linear ﬁlter is perfectly able to reach any point in the optimal bound.

Original: For intermediate cases, the linear ﬁlter was capable of reaching the bound in the region where no utility is compromised, but was not capable of following the optimal tradeoff line for higher levels of privacy.
Revised: For intermediate cases, the linear ﬁlter was capable of reaching the bound in the region where no utility is compromised, but was not capable of following the optimal tradeoff line for higher levels of privacy.

Original: [Figure]
Revised: [Figure]

Original: 7. I MPLEMENTATION DETAILS
Revised: 7. I MPLEMENTATION DETAILS

Original: Here, we explicitly elaborate on how we optimize the data-driven loss functions shown in equations 8, 9, and 10 using an adversarial approach.
Revised: Here, we explicitly elaborate on how we optimize the data-driven loss functions shown in equations 8, 9, and 10 using an adversarial approach.

Original: We ﬁrst detail the exact adversarial training setup that was used to perform the experiments in Section 5, and then provide the concrete network architectures used for all shown results.
Revised: We ﬁrst detail the exact adversarial training setup that was used to perform the experiments in Section 5, and then provide the concrete network architectures used for all shown results.

Original: 7.3. A LGORITHMIC IMPLEMENTATION
Revised: 7.3. A LGORITHMIC IMPLEMENTATION

Original: Minimizing the objective functions in equations 8, 9, and 10, is a challenging problem in general.
Revised: Minimizing the objective functions in equations 8, 9, and 10, is a challenging problem in general.

Original: By focusing our attention on Eq. 8, we see that each of the four loss terms have a distinct purpose:
Revised: By focusing our attention on Eq. 8, we see that each of the four loss terms have a distinct purpose:

Original: [Equation]
Revised: [Equation]

Original: The ﬁrst three loss terms minimize a crossentropy objective for functions P
Revised: The ﬁrst three loss terms minimize a crossentropy objective for functions P

Original: η ( s | q ) , P ψ ( u | q ) , and
Revised: η ( s | q ) , P ψ ( u | q ) , and

Original: P φ ( u | x ) ; this ensures that these functions are good estimators of the unknown true distributions of
Revised: P φ ( u | x ) ; this ensures that these functions are good estimators of the unknown true distributions of

Original: P ( s | q ) , P ( u | q ) , and P ( u | x ) , where samples q are drawn from the learned sanitization mapping q = Q θ ( x, z ) .
Revised: P ( s | q ) , P ( u | q ) , and P ( u | x ) , where samples q are drawn from the learned sanitization mapping q = Q θ ( x, z ) .

Original: The ﬁnal loss term attempts to ﬁnd the best possible sampling function Q θ ( x, z ) such that (1 − α )
Revised: The ﬁnal loss term attempts to ﬁnd the best possible sampling function Q θ ( x, z ) such that (1 − α )

Original: I 2 ( U ; X | Q ) + αI 2 ( S ; Q ) is minimized.
Revised: I 2 ( U ; X | Q ) + αI 2 ( S ; Q ) is minimized.

Original: We can approximately solve this problem by applying iterative Stochastic Gradient Descent to each of the individual loss terms with respect to their relevant parameters, this is similar to the procedure used to train Generative Adversarial Networks.
Revised: We can approximately solve this problem by applying iterative Stochastic Gradient Descent to each of the individual loss terms with respect to their relevant parameters, this is similar to the procedure used to train Generative Adversarial Networks.

Original: The algorithm we used to solve Eq.
Revised: The algorithm we used to solve Eq.

Original: 8 is shown in Algorithm 1, similarly, algorithms to solve Eq.and Eq.
Revised: 8 is shown in Algorithm 1, similarly, algorithms to solve Eq.and Eq.

Original: 10 are shown in Algorithm 2 and Algorithm 3 respectively.
Revised: 10 are shown in Algorithm 2 and Algorithm 3 respectively.

Original: ( θ, η, φ, ψ ) ← initialize network parameters 1: repeat 2: 1) , u (
Revised: ( θ, η, φ, ψ ) ← initialize network parameters 1: repeat 2: ( x (1) , u (

Original: [Equation]
Revised: [Equation]

Original: , s (1)
Revised: , s (1)

Original: [Equation]
Revised: [Equation]

Original: , ... ( x (
Revised: , ... ( x (

Original: [Equation]
Revised: [Equation]

Original: , u (
Revised: , u (

Original: [Equation]
Revised: [Equation]

Original: , s (
Revised: , s (

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: P
Revised: P

Original: [Equation]
Revised: [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: (cid:46)
Revised: (cid:46)

Original: Draw b samples from joint distribution 3: z (
Revised: Draw b samples from joint distribution 3: z (

Original: [Equation]
Revised: [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: P
Revised: P

Original: [Equation]
Revised: [Equation]

Original: (cid:46)
Revised: (cid:46)

Original: Draw b samples from sampling distribution 4: Φ( φ ) =
Revised: Draw b samples from sampling distribution 4: Φ( φ ) =

Original: [Equation]
Revised: [Equation]

Original: (cid:46) Evaluate crossentropy loss on raw utility inference 5:
Revised: (cid:46) Evaluate crossentropy loss on raw utility inference 5:

Original: φ ← φ −
Revised: φ ← φ −

Original: [Equation]
Revised: [Equation]

Original: ) (cid:46) Stochastic gradient descent step on P
Revised: ) (cid:46) Stochastic gradient descent step on P

Original: [Equation]
Revised: [Equation]

Original: u | x ) 6: Ψ
Revised: u | x ) 6: Ψ

Original: [Equation]
Revised: [Equation]

Original: ψ
Revised: ψ

Original: [Equation]
Revised: [Equation]

Original: =
Revised: =

Original: [Equation]
Revised: [Equation]

Original: b
Revised: b

Original: [Equation]
Revised: [Equation]

Original: (cid:46) Evaluate crossentropy loss on ﬁltered utility inference 7: ψ
Revised: (cid:46) Evaluate crossentropy loss on ﬁltered utility inference 7: ψ

Original: [Equation]
Revised: [Equation]

Original: (cid:46) Stochastic gradient descent step on P
Revised: (cid:46) Stochastic gradient descent step on P

Original: [Equation]
Revised: [Equation]

Original: ( u | q ) 8:
Revised: ( u | q ) 8:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: (cid:46) Evaluate crossentropy loss on secret inference 9: η ← η
Revised: (cid:46) Evaluate crossentropy loss on secret inference 9: η ← η

Original: [Equation]
Revised: [Equation]

Original: ∇
Revised: ∇

Original: [Equation]
Revised: [Equation]

Original: H
Revised: H

Original: [Equation]
Revised: [Equation]

Original: η ) (cid:46) Stochastic gradient descent step on P η
Revised: η ) (cid:46) Stochastic gradient descent step on P η

Original: ( s | q ) 10:
Revised: ( s | q ) 10:

Original: [Equation]
Revised: [Equation]

Original: (cid:3)
Revised: (cid:3)

Original: [Equation]
Revised: [Equation]

Original: Evaluate sanitation loss 11: θ ←
Revised: Evaluate sanitation loss 11: θ ←

Original: [Equation]
Revised: [Equation]

Original: θ ) (cid:46) Stochastic gradient descent step on Q θ ( x, z ) 12: until convergence 7.3.
Revised: θ ) (cid:46) Stochastic gradient descent step on Q θ ( x, z ) 12: until convergence 7.3.

Original:  N ETWORK ARCHITECTURES
Revised:  N ETWORK ARCHITECTURES

Original: We now describe the exact architecture used to implement the privacy ﬁlter on all experiments shown in Section 5.
Revised: We now describe the exact architecture used to implement the privacy ﬁlter on all experiments shown in Section 5.

Original: Figure 8 shows the network diagram.
Revised: Figure 8 shows the network diagram.

Original: The architecture presented in Figure 8 is fully convolutional, so the same network deﬁnition could be used across all three experiments by varying the input layer.
Revised: The architecture presented in Figure 8 is fully convolutional, so the same network deﬁnition could be used across all three experiments by varying the input layer.

Original: To speed up convergence to a good ﬁltering solution, ﬁlters were initially trained to copy the image (under RMSE loss), and optionally infer some meaningful attribute from the input (in subject-within-subject , this attribute was a simple class label on whether the subject wished their privacy preserved).
Revised: To speed up convergence to a good ﬁltering solution, ﬁlters were initially trained to copy the image (under RMSE loss), and optionally infer some meaningful attribute from the input (in subject-within-subject , this attribute was a simple class label on whether the subject wished their privacy preserved).

Original: We stress that this was only done for initialization, ﬁnal training of the network was done exactly as described in Algorithm 1.
Revised: We stress that this was only done for initialization, ﬁnal training of the network was done exactly as described in Algorithm 1.

Original: ( θ, η ) ← initialize network parameters φ ← ˆ φ Utility inference algorithm is ﬁxed and known 1: repeat 2: ( x (1) , u (1) , s (1) ) , ...
Revised: ( θ, η ) ← initialize network parameters φ ← ˆ φ Utility inference algorithm is ﬁxed and known 1: repeat 2: ( x (1) , u (1) , s (1) ) , ...

Original: ( x ( b ) , u ( b ) , s ( b ) ) ∼ P X,U,S (cid:46)
Revised: ( x ( b ) , u ( b ) , s ( b ) ) ∼ P X,U,S (cid:46)

Original: Draw b samples from joint distribution 3: z (1) , ...
Revised: Draw b samples from joint distribution 3: z (1) , ...

Original: z ( b ) ∼ P Z (cid:46)
Revised: z ( b ) ∼ P Z (cid:46)

Original: Draw b samples from sampling distribution 4:
Revised: Draw b samples from sampling distribution 4:

Original: H ( η ) = 1 b (cid:80) bi =1 − logP η
Revised: H ( η ) = 1 b (cid:80) bi =1 − logP η

Original: ( s i | Q θ ( x i , z i ))
Revised: ( s i | Q θ ( x i , z i ))

Original: (cid:46) Evaluate crossentropy loss on secret inference 5: η ← η − lr ∇ η H ( η ) (cid:46) Stochastic gradient descent step on P η ( s | q ) 6: Θ( θ ) =
Revised: (cid:46) Evaluate crossentropy loss on secret inference 5: η ← η − lr ∇ η H ( η ) (cid:46) Stochastic gradient descent step on P η ( s | q ) 6: Θ( θ ) =

Original: (1 − α ) (cid:2) 1 b (cid:80) bi =1 log
Revised: (1 − α ) (cid:2) 1 b (cid:80) bi =1 log

Original: P φ ( u i | x i ) P
Revised: P φ ( u i | x i ) P

Original: φ ( u i | Q θ ( x i ,z i )) (cid:3) 2 + α (cid:2) 1 b (cid:80) bi =1 log P
Revised: φ ( u i | Q θ ( x i ,z i )) (cid:3) 2 + α (cid:2) 1 b (cid:80) bi =1 log P

Original: η
Revised: η

Original: ( s i | Q θ ( x i ,z i )))
Revised: ( s i | Q θ ( x i ,z i )))

Original: P ( s i ) (cid:3)(cid:46)
Revised: P ( s i ) (cid:3)(cid:46)

Original: Evaluate sanitation loss 7: θ ← θ − lr ∇ θ Θ( θ ) (cid:46) Stochastic gradient descent step on Q θ ( x, z ) 8: until convergence φ ← ˆ φ Utility inference algorithm is ﬁxed and known
Revised: Evaluate sanitation loss 7: θ ← θ − lr ∇ θ Θ( θ ) (cid:46) Stochastic gradient descent step on Q θ ( x, z ) 8: until convergence φ ← ˆ φ Utility inference algorithm is ﬁxed and known

Original: η ← ˆ η Secret inference algorithm is ﬁxed and known 1: repeat 2: ( x (1) , u (1) , s (1) ) , ...
Revised: η ← ˆ η Secret inference algorithm is ﬁxed and known 1: repeat 2: ( x (1) , u (1) , s (1) ) , ...

Original: ( x ( b ) , u ( b ) , s ( b ) ) ∼ P X,U,S (cid:46)
Revised: ( x ( b ) , u ( b ) , s ( b ) ) ∼ P X,U,S (cid:46)

Original: Draw b samples from joint distribution 3: z (1) , ...
Revised: Draw b samples from joint distribution 3: z (1) , ...

Original: z (
Revised: z (

Original: [Equation]
Revised: [Equation]

Original: (cid:46)
Revised: (cid:46)

Original: Draw b samples from sampling distribution
Revised: Draw b samples from sampling distribution

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Evaluate sanitation loss 5:
Revised: Evaluate sanitation loss 5:

Original: [Equation]
Revised: [Equation]

Original: Stochastic gradient descent
Revised: Stochastic gradient descent

Original: [Equation]
Revised: [Equation]

Original: z
Revised: z

Original: [Equation]
Revised: [Equation]

Original: 6: until convergence
Revised: 6: until convergence

Original: The architecture of the networks used to infer the utility and secret attribute in the emotion vs. gender experiment are identical, and are shown in Figure 9.
Revised: The architecture of the networks used to infer the utility and secret attribute in the emotion vs. gender experiment are identical, and are shown in Figure 9.

Original: Networks used for the experiments in Section 7.2 are shown in Figure 10.
Revised: Networks used for the experiments in Section 7.2 are shown in Figure 10.

Original: All other networks used in the results section are implemented as described in their respective papers.
Revised: All other networks used in the results section are implemented as described in their respective papers.

Original: [Figure]
Revised: [Figure]