I NTERPRETABLE C OMPLEX -V ALUED N EURAL N ETWORKS FOR P RIVACY P ROTECTION
A BSTRACT
Previous studies have found that an adversary attacker can often infer unintended input information from intermediate-layer features
We study the possibility of preventing such adversarial inference yet without too much accuracy degradation
We propose a generic method to revise the neural network to boost the challenge of inferring input attributes from features , while maintaining highly accurate outputs
In particular the method transforms real-valued features into complex valued ones in which the input is hidden in a randomized phase of the transformed features
The knowledge of the phase acts like a key, with which any party can easily recover the output from the processing result but without which the party can neither recover the output nor distinguish the original input.
Preliminary experiments on various datasets and network structures have shown that our method signiﬁcantly diminishes the adversary’s ability in inferring about the input while largely preserves the resulting accuracy.
I NTRODUCTION
Deep neural networks (DNNs) have shown superb capabilities to process massive volume of data, and local devices such as mobile phones, medical equipment, Internet of Things (IoT) devices have become major data entry points in recent years.
Although on-device machine learning has exhibited various advantages, it usually burdens thin devices with overwhelming computational overhead.
Yet ofﬂoading data or processed features to a cloud operator would put the individual privacy at risk.
For example, if a user has a virtual assistant at home, it should not worry about its private data being collected and processed by an untrusted cloud operator.
The operator, on the other hand, should not be able to recover original signals or their interpretation.
However, as shown in the previous literature (Dosovitskiy & Brox (2016); Zeiler & Fergus (2014); Mahendran & Vedaldi (2015); Shokri et al.
Ganju et al.
; Melis et al.
, intermediatelayer features face many privacy threats, where the adversary either reconstructs the input or infers unintended properties about the input.
Hence, on-device processing encounters a dilemma, i.e. while we expect intermediate-layer features to yield high accuracy, we certainly would not want sensitive information to be leaked.
Therefore, we propose a novel method which tweaks a conventional neural network into a complexvalued one, such that intermediate-layer features are released without sacriﬁcing input privacy too much.
More precisely, we turn the original real-valued features into complex-valued ones, rotate these features by a random angle, and feed them to the cloud for further processing.
We face two signiﬁcant challenges in the design.
First, the tweaked features have to be correctly handled by the DNN on the cloud.
Although network structures vary depending on the input types, it is desired that the piecewise linearity of features to be preserved, so that the resulting accuracy does not degrade too much compared with the original features.
Second, an adversary attacker who intercepts the features in the middle should not be able to recover the exact input, nor can it ﬁgure out the correct output.
Most importantly, the neural network is supposed to be trained using the original data without additional human supervision, and is efﬁcient to conduct inference.
To overcome the ﬁrst challenge, we tailor operations of DNN to make the succeeding computation at the cloud invariant to feature rotations, i.e., the DNN can correctly handle the feature and preserve the rotated angle in the output.
For the second issue, we adopt generative adversarial networks (GAN) to generate synthesized features to hide the original ones.
It guarantees k -anonymity such that, when an adversary tries to recover the original input from the complex-valued features, it would get at least k different inputs (Please see Appendix B for detailed discussion).
Each of the k reconstructed inputs has equivalent probabilities of being the original input for the attacker.
Apart from the GAN part, the training of the neural network adds little additional computation overhead and requires no extra denotations.
Contributions of this study can be summarized as follows.
We propose to transform conventional
DNNs into complex-valued ones, which hide input information into a randomly chosen phase.
Only the party with the phase information can retrieve the correct output.
Without it, any party can neither recover the input nor the output.
Tested on various datasets and DNNs, our method has been shown to yield only moderate computational overhead and little accuracy degradation, while signiﬁcantly diminishes the adversary’s ability of inferring about the input.
R ELATED W ORK
Complex-valued neural networks.
Using complex-valued features or parameters in neural networks has always been an interesting topic.
From the computational perspective, Trabelsi et al.
(2018) showed that complex-valued neural networks have a competitive performance with their real-valued counterparts.
By augmenting recurrent neural networks with associative memory based on complexvalued vectors, Danihelka et al.
(2016) achieved faster learning on memorization tasks.
Complexvalued features can contain information in both the phase and the magnitude.
An example is that
Reichert & Serre (2013) used the phase to indicate properties of spike timing in cortical information processing.
Zhang et al.
(2019) used the quaternion-valued neural network to learn 3D-rotationequivariant features for 3D point cloud processing.
We take advantage of complex-valued features such that original features can be hidden in an unknown phase.
Also, Yang et al.
(2019) shared a similar transformation-based approach as ours while it performed transformation on inputs rather than features, and it aimed to improve the adversarial robustness of the model.
Privacy-preserving deep learning.
Various privacy-preserving mechanisms have been proposed using different deﬁnitions of privacy: Osia et al.
(2017) applied the Siamese architecture to separate the primary and private information so that the primary information was preserved in the feature.
PrivyNet by Li et al.
(2017) was proposed to decide the local DNN structure under the privacy constraint based on the peak signal-to-noise ratio or the pixel-wise Euclidean distance.
Data nulliﬁcation and random noise addition were introduced by Wang et al.
(2018) to protect private information in the features, which guaranteed differential privacy.
Cryptographic tools have been used to learn from sensitive data.
Zhang et al.
(2016) adopted homomorphic encryption, in particular, BGV encryption, to encrypt the private data and perform the high-order back-propagation on the encrypted data; Mohassel & Zhang (2017) distributed the private data among two non-colluding servers who performed the secure two-party computation to train models on the joint data.
Our scheme achieves k -anonymity privacy guarantee such that any adversary can at best reconstruct a number of synthetic inputs from the transformed features and thus it cannot distinguish the original input from others.
T HREAT M ODEL AND P RIVACY G UARANTEE
In this section, we brieﬂy introduce the threat model and the privacy guarantee that our scheme aims to achieve.
Threat model.
In our model, a user processes its raw data locally and transmits the neural network features to the cloud for further processing.
An adversary would intercept the transferred features and perform either feature inversion attacks or property inference attacks on these features to either reconstruct inputs, or infer unintended information.
Typical examples of the former attacks include feature inversion by Dosovitskiy & Brox (2016), gradient-based visualization by Zeiler & Fergus (2014); Mahendran & Vedaldi (2015), etc.
And the latter ones include membership inference attack
[Figure]
Rotate
Adversarial learning
Adversary g a b exp( − iθ ) exp( iθ ) ˆ
I h
d ˆ y Φ I x (a) Structure of the complex-valued neural network.
Revised layers
Adversarial loss noise γ · ε
[Figure]
With noises
With additional layers
Complex‐valued network (b) Network structures in experiments.
by Shokri et al. (2017), passive property inference attack by Ganju et al. (2018) as well as feature leakage in collaborative learning by Melis et al.
k -anonymity.
We aim to achieve the following privacy guarantee: when an adversary tries to reconstruct the original input from the transformed features, it can sythesize inputs belonging to k different prototypes with equivalent likelihoods, and only one of them corresponds to the original input.
A PPROACH 4. O VERVIEW
To ﬁght against the above threats, we propose to revise the conventional DNN.
The new structure is shown in Fig.
1a, where the entire network is divided into the following three modules.
• Encoder is embedded inside a local device at the user end.
The encoder extracts feature from the input, hides true feature by rotating the features by a randomized angle, and sends the encoded result to the cloud.
• Processing module is located at the public cloud.
This module receives and processes the encoded features without knowing the rotation.
At the end of processing, the cloud returns the output to the user.
Decoder resides at the user’s local device.
The decoder receives and decodes results sent from the cloud to obtain the ﬁnal result.
The three modules are jointly trained.
Once trained, the encoder and decoder are placed at the local device, whereas the processing module resides on the cloud for public use.
We will illustrate the detail of each module in the following section.
4. C OMPLEX -V ALUED N EURAL N ETWORKS
Let ( I, y )
∈
D denote an input and its label in the training dataset and g be the encoder at the local device.
Given the input I , the intermediate-layer feature is computed as
[Equation]
but we do not directly submit a to the cloud.
Instead, we introduce a fooling counterpart b to construct a complex-valued feature as follows:
[Equation]
where θ and b are randomly chosen.
b is the fooling counterpart which does not contain any private information of a , but its magnitude is comparable with a to cause obfuscation.
The encoded feature is then sent to the processing module Φ , which produces the complex-valued feature h =
Φ ( x ) .
Upon receiving h , the decoder makes prediction ˆ y on I by inverting the complex-valued feature h back:
[Equation]
where d denotes the decoder module, which can be constructed as either a shallow network or just a softmax layer.
(cid:60) ( · ) denotes the operation of picking real parts of complex values.
Processing Module Φ .
The core design of the processing module is to allow the complex-valued feature h =
Φ ( x ) to be successfully decoded later by the decoder.
I.e. if we rotate the complexvalued feature a + bi by an angle θ , all the features of the following layers are supposed to be rotated by the same angle.
We represent the processing module as cascaded functions of multiple layers Φ ( x ) =
Φ n (Φ n − 1 ( · · · Φ 1 ( x ))) , where Φ j ( · ) denotes the function of the j -th layer and f j = Φ j ( f j − 1 ) represents the output of the j -th layer.
Thus the processing module should have the following property:
[Equation]
In other words, the function of each intermediate layer in the processing module should satisfy
[Equation]
to recursively prove Eqn.
Let us consider six most common types of network layers to construct the processing module, i.e. the convolutional layer, the ReLU layer, the batch-normalization layer, the average/max pooling layer, the dropout layer, and the skip-connection operation.
For the convolutional layer, we remove the bias term and obtain Conv ( f ) =
w ⊗ f , which satisﬁes Eqn.
Inspired by Trabelsi et al.
(2018), we replace the ReLU with the following non-linear layer:
[Equation]
where f ijk denotes the neural activation at the location ( i, j ) in the k -th channel of the feature, and c is a positive constant.
Likewise, the batch-normalization operation is replaced by
[Equation]
where f l denotes the complex-valued tensor for the l -th sample in the batch.
For max-pooling layers, we modify the rule such that the feature with the maximum norm in the region is selected, which ensures that max-pooling does not change the phase of its input.
For the dropout layer, we randomly drops out both the real and imaginary parts of complex-valued features.
Skip connections can be formulated as f + Φ( f ) , where the inner module Φ( f ) recursively satisﬁes Eqn.
All above six operations satisfy Eqn.
Please see supplementary materials for the proof.
GAN-based Encoder.
The objective of the encoder is to hide the real feature a of the input I in a certain phase θ of the encoded feature x = exp( iθ ) (cid:2) a + bi (cid:3) .
Let a (cid:48)
= (cid:60) [ x exp( − iθ (cid:48) )]
= (cid:60) [( a + bi ) exp
( iθ − iθ (cid:48) )]
= (cid:60) [( a + bi ) exp( i ∆ θ )] denote a feature decoded using a random angle θ (cid:48)
(cid:54)
= θ , where ∆ θ = θ − θ (cid:48) .
An ideal encoder requires (i) the decoded feature a (cid:48) contains sufﬁcient information to cause obfuscation with the real feature a ; (ii) a (cid:48) and a follow the same distribution so that it is hard to distinguish which one is the real one.
Hence, we train the encoder g with a range of ∆ θ ’s and b ’s, and adopt a GAN to distinguish different values of them.
Letting D denote the discriminator, we train the encoder g over the WGAN (Arjovsky et al.
(2017)) loss:
[Equation] [Equation]
g generates features to fool D .
Upon convergence, the distribution of a (cid:48) approximates that of a .
Note that the loss is the expectation over uniform-randomly distributed θ ∈ (0 , 2 π ) .
Ideally, the expectation in Eqn.
(8) should also be taken over all possible ∆ θ (cid:54) = 0 , and thus when an adversary tries to recover a by randomly rotating an angle, it will generate an inﬁnite number of features following the same distribution as that of a .
Empirically, we pick k − 1 such ∆ θ ’s uniformly over (0 , π ) and iterate through these k − 1 values as negative samples in the adversarial learning.
The GAN-based encoder is the key to our k -anonymity guarantee such that it ensures the real feature cannot be distinguished from at least k − 1 synthetic features.
Please ﬁnd the end of Appendix B to see the visualization effect of our privacy guarantee.
The overall loss of learning is formulated as follows, which contains the adversarial loss in Eqn.
(8) and a loss for the target task:
[Equation]
(9) where L task (ˆ y, y ) represents the loss for the target task.
Note that to simplify the implementation, we compute b =
g ( I (cid:48) ) as the feature of a randomly chosen sample I (cid:48) (cid:54)
=
I where ideally I (cid:48) has little correlation with I .
In sum, the entire neural network [ g, Φ , d ] is trained with randomized variables θ
and b to minimize the loss in Eqn.
Once trained, the network [ g, Φ , d ] is ﬁxed and publicly released.
At the inference phase, the encoder secretly selects a fooling counterpart b and a rotation angle θ to encode its real feature a .
The decoder receives the processed result h from the cloud, and make the ﬁnal prediction based on Eqn.
4. A TTACKS TO C OMPLEX -V ALUED DNN S
We will materialize the attacks described in the threat model in Sec. 3 and make them speciﬁc to our proposed complex-valued DNNs.
Feature inversion attacks: The adversary performs two types of attacks.
In inversion attack 1 , the adversary tries to ﬁnd out the most likely rotated angle ˆ θ to revert the feature x and obtain a ∗ .
An adversary learns to use a ∗ to reconstruct the input ˆ
I = dec ( a ∗ ) .
Here we deﬁne a ∗ = (cid:60) [ x exp( − i ˆ θ )] as the most probable feature recovered by the adversary.
The adversary, for instance, can build a new discriminator D (cid:48) to obtain ˆ θ = max θ D (cid:48)
( (cid:60) [ x exp( − iθ )]) .
In inversion attack 2 , the adversary learns to directly reconstruct the targeted input from the features, i.e., ˆ I = dec ( x ) .
We show that our adversarial training strategy boosts the difﬁculty of learning such a decoder.
Let g ∗ and
D ∗ denote the learned encoder and discriminator, respectively.
Based on g ∗ , let us construct the following discriminator ˆ D ( a (cid:48) )
= −(cid:107) g ∗ ( I ) − g ∗ ( dec ( a (cid:48) ))
(cid:107) .
The larger ˆ D ( a (cid:48) ) indicates the higher similarity with the real input.
Because D ∗ is learned via D ∗ = arg max D L ( g ∗ , D ) , we have
L ( g ∗ , D ∗ ) ≥ L ( g ∗ , ˆ D ) .
The adversarial loss in Eqn.
(8) provides an upper bound of L ( g ∗ , ˆ D ) , and thus restricts the capability of dec ( · ) .
Property inference attacks: By Ganju et al.
(2018), ‘property’ refers to the input attribute, which can be any sensitive information to protect or any attribute not expected to be released with features.
For example, given a facial image dataset and an age recognition task, the gender attribute is required to hide in features.
By labeling features with properties of the corresponding inputs, the adversary is able to train classiﬁers on a dataset consisting all the feature-property pairs.
Once trained, the classiﬁers can use intermediate-layer features to infer if the input possesses certain properties.
We consider four attacking strategies.
Inference attack 1: the adversary uses raw images to train a classiﬁer to predict hidden properties of the input.
At the testing phase, the attacker feeds the reconstructed result dec ( a ∗ ) from inversion attack 1 to the classiﬁer to predict hidden properties.
Inference attack 2: the adversary ﬁrst rotates x ’s by their respective ˆ θ to estimate the most likely feature a ∗ .
The adversary trains and tests the classiﬁer on a ∗ to predict hidden properties.
Inference attack 3: the adversary uses the result of inversion attack 1 dec ( a ∗ ) to train and test a classiﬁer to predict hidden properties.
Inference attack 4: different from the aforementioned classiﬁcation approach, we let the adversary compares a ∗ against features of each training example to ﬁnd its k -nearest neighbors ( k -NNs) in the training set and use them to infer the hidden properties.
If a ∗ contains sufﬁcient information to recover some property, aforementioned attackers would learn the relationship between a ∗ (or dec ( a ∗ ) ) and the hidden property.
Otherwise, the model would fail.
[Figure]
[Figure]
[Table]
E XPERIMENTS
We revised a variety of classical DNNs to complex-valued DNNs and tested them on different datasets to demonstrate the broad applicability of our method.
Without loss of generality, tasks include object classiﬁcation and face attribute estimation, but do not exclude other tasks on DNNs.
We have applied a total of two inversion attacks and four inference attacks to the complex-valued DNNs for testing the privacy performance.
5. I MPLEMENTATION D ETAILS
Complex-valued DNNs: We constructed complex-valued DNNs based on 8 classical DNNs in total, which included the ResNet-20/32/44/56/110 (He et al.
(2016)), the LeNet (LeCun et al.
(1998)), the VGG-16 (Simonyan & Zisserman (2015)), and the AlexNet (Krizhevsky et al.
As shown in Fig.
1a, we divided each original DNN into three modules which were referred to as the encoder/processing module/decoder correspondingly.
The structure is given by the top row of Fig.
1b.
The bottom row of Fig.
1b gives the architecture of revised DNNs.
Given the original DNNs, the encoder/processing/decoder modules were divided as follows.
For the residual network, we tested two variants — ResNet - α and ResNet - β — in the α -variant, the output of the layer before the ﬁrst 16 × 16 feature map was fed to the aforementioned GAN, and layers following the ﬁrst 8 × 8 feature map constituted the decoder.
The β -variant was the same with the α -variant except that the decoder was composed by the last residual block and the layers following it.
The processing module of a residual network was modiﬁed such that c = 1 in δ ( · ) for all non-linear layers.
The encoder of the LeNet consisted of the ﬁrst convolutional layer and the GAN, whereas its decoder only contained the softmax layer.
All layers before the last 56 × 56 feature map of VGG-16 comprised the encoder.
The decoder consisted of fully-connected layers and the softmax layer.
For the AlexNet, the output of the ﬁrst three convolutional layers was fed into GAN, and the decoder contained fully-connected layers and the softmax layer.
In the processing modules of these DNNs, we set c k = E ij (cid:107) x (cid:48) ijk (cid:107) for neural activations in the k -th channel. [Table]
[Table] Baselines: Beside the complex-valued DNN, we constructed three baseline networks for comparison.
Original DNNs (baseline 1): The original DNN without any revision was taken as the ﬁrst baseline network.
For ease of presentation, we also divided the original DNNs into the encoder
Noisy DNNs (baseline 2): Based on the original DNNs, we injected noise right after the encoder module, which was given as a + γ · (cid:15) (we set γ = 0 .
The noisy feature was fed to the processing module instead of a , as shown in the second row of Fig.
1b.
Here (cid:15) represents a high-dimensional random noise with the same average magnitude as a .
DNNs with additional layers (baseline 3): Since the encoder was based on GAN, additional layers needed to be added, when we revised the DNN.
We chose a GAN which incorporated a generator consisting of a convolutional layer with 3 × 3 × K ﬁlters, and a discriminator composed by a convolutional layer as well as a fully-connected layer.
We designed this baseline for fair comparison, because additional layers in GAN, although without adversarial loss, would incur model structure changes.
Its structure is illustrated by the third row of Fig.
1b.
Attacks: Privacy attacking was implemented as follows.
(1) Inversion attacks: we implemented the inversion attacker based on U-net (Ronneberger et al.
The original U-net consisted ofblocks, and we revised the U-net to construct the attacker.
The input feature of the U-net was ﬁrst up-sampled to the size of the input, which will be fed into the inversion model.
There were four down-sampling blocks and four up-sample blocks. Each block contained six convolutional layers for better reconstruction performance. Each down-sample block reduced the size of the feature by half. Each up-sample block doubled the size of the feature map.
Thus, the output of the inversion model was of the same size as the input image.
(2) Inference attacks: we selected CelebA and CIFAR-100 datasets to test robustness against property inference attacks.
For CelebA, we evaluated the accuracy performance on classifying 30 attributes and the privacy performance on the restattributes.
Likewise, the accuracy of the DNN on CIFAR-100 was evaluated by the classiﬁcation error of the major 20 superclasses, and the privacy was gauged by the classiﬁcation error of theminor classes.
CelebA and CIFAR-100 adopted the AlexNet and the ResNet-56, respectively, as prototype models.
Their attacker nets were implemented as the ResNet-50 and the ResNet-56, respectively. [Figure] [Figure] )/(d).
[Table]
5. E VALUATION METRICS
We evaluated three aspects of the revised DNNs’ performance: accuracy, privacy [Table] and efﬁciency.
Accuracy concerned the performance of the model on the task.
Privacy was measured by the robustness of our DNNs against inversion attacks and inference attacks.
More speciﬁcally, for inversion attacks, we had the following measures: (1) the average error of the estimation about the rotated angle θ ∗ , i.e. | θ ∗ − ˆ θ | ; (2) the pixel-level reconstruction error E [ (cid:107) ˆ
I − I (cid:107) ] where the value of each pixel was scaled to [0 , 1] ; (3) failure rate of human identiﬁcation of the reconstructed images.
For inference attacks, we measured the robustness of DNNs by the error rate of each attack model (see Sec. 4.3).
As to efﬁciency , we measured the processing time compared with the baseline.
5. E XPERIMENTAL R ESULTS AND A NALYSIS
Fig.
2 visualizes images reconstructed using features of different baseline networks.
Due to space constraint, this ﬁgure only shows partial results.
For a complete result, please refer to the supplementary ﬁle.
Visual effects were signiﬁcant as the reconstruction in the bottom two rows greatly shifted away from the original input.
Obviously, other misleading input attributes were mixed up with the original ones.
To further examine the effect, we compared classiﬁcation error rates and reconstruction errors on a variety of datasets and DNNs in Table 1 and 2.
Since the revised DNNs introduced additional layers to the original DNNs, we compared the performance of both the original
DNNs as well as those with additional layers.
Our complex-valued DNNs achieved similar utility performance, and exhibited signiﬁcantly higher reconstruction error in almost all groups.
Further, we mimiced the adversary to recover the rotated angle θ ∗ with the help of a discriminator model.
Most errors fell into ( π/ 4 , π/ 2) according to Table 4, which indicates even the discriminator could not tell the original features.
We also qualitatively tested the reconstructed result in Table 3.
Fig.
3 and Table 5 show the error rates in inferring hidden properties by attackers.
We observed that in Fig.
3-(a),(c), the error rate of the inference attack 1 on the complex-valued DNNs (dec ( a ∗ ) ) was signiﬁcantly higher than on the baseline 1 (raw images) and baseline 3 (dec ( a ) ), and was close to random selection ( 99% ) on CIFAR-100.
We further tested inference attack 2 and 3.
In Fig.
3-(b),(d), the error rates of the attacker nets trained on a ∗ and dec ( a ∗ ) were both signiﬁcantly higher than that of baseline 3, i.e. a ∗ indicated little about the hidden properties.
k -NN methods yielded similar results.
Last but not least, we compared the running time of processing the images with different
DNNs.
Batch size of 128 and 100 are used respectively for CelebA and CIFAR-100.
It is shown that the complex-valued DNNs had comparable performance with the baseline.
C ONCLUSION AND D ISCUSSIONS
We propose a novel method to preserve input privacy in the intermediate-layer features of deep neural networks.
The method transforms a traditional DNN into a complex-valued one.
Our method has been tested on a variety of datasets and models.
The experimental results have shown the method effectively boosts the difﬁculty of inferring inputs for the adversary, while largely preserving accuracy for the user.
Please also ﬁnd in the appendices for supplemental experiments.
Theoretically, not only the encoder output but also all other intermediate-layer features in the processing module can preserve privacy.
However, we only need to invert the encoder output to test the privacy performance, since all features in successive layers can be expressed as cascaded functions of the encoder output.
Thus we may consider the privacy performance of the encoder output as the worst case for all features in the processing module. A CKNOWLEDGEMENTS
This work was partially supported by National Natural Science Foundation of China (U19B2043, 61906120, and 61902245), and the Science and Technology Innovation Program of Shanghai (Grant 19YF1424500).
A P ROOF OF Φ( e iθ x ) = e iθ Φ( x )
In this paper, we design the processing module to ensure features of all layers are rotated by the same angle, in order to enable the later decryption of the feature.
[Equation]
where f ( θ ) j and f (0)
j represent the feature map computed using the input x ( θ ) and that computed using the input x (0) , respectively.
In order to prove the above equation, we revise basic layers/operations in the processing module to ensure
[Equation]
where Φ( · ) denotes the function of a certain layer/operation.
x is given as the input of the speciﬁc layer/operation Φ( · ) .
Based on this equation, we can recursively prove f ( θ ) j
[Equation]
Let us consider the following six most common types of layers/functions to construct the processing module, i.e. the conv-layer, the ReLU layer, the batch-normalization layer, the average/max pooling layer, the dropout layer, and the skip-connection operation.
We revise the conv-layer by omitting the bias term.
Thus, we get
[Equation]
We replace the ReLU layer with the non-linear activation function of φ ( x ijk ) =
[Equation]
Thus, we can write the element-wise operation as follows.
[Equation]
We replace the batch-normalization layer with the function of φ ( x lijk ) =
[Equation]
Thus, we can write the element-wise operation as follows.
[Equation]
For the the average/max pooling layer and the dropout layer, we can represent their functions in the form of Φ( x ) =
Ax , where x is given as a vectorized feature, and A denotes a matrix.
For the average/max-pooling operation, A represents the selection of neural activations.
For the dropout layer, A contains binary values that indicate the dropout state.
In this way, we get
[Equation]
For the skip-connection operation, we get
[Equation]
where Ψ( · ) denotes the function that is skipped by the connection.
We can recursively ensure Ψ( e
[Equation]
x ) =
e
[Equation]
Ψ( x )
[Equation]
B A RCHITECTURE OF THE GAN
The architecture of GAN is based on the residual network.
The generator consists of an input convolutional layer, a residual block from the residual network, and a convolutional layer for the output.
The residual block contains two convolutional layers, and a skip connection.
Thus, there are four convolutional layers in the generator. The output of the generator is of the same size as the input. The architecture of the discriminator is similar to that of the generator, but the output of the discriminator is a scalar instead of a tensor. C E XPERIMENTS : V ISUALIZATION
Fig.
4, Fig. 5 and Fig.
6 respectively give the visualization effect on CIFAR-10, CUB200-2011, and
CelebA, when reconstructing the inputs from features.
Fig.
7 shows the reconstructed input images when an adversary launches a feature inversion attack: it rotates x by an angle continuously drawn from (0 , 2 π ) and then reconstruct the input on the rotated features.
The ﬁrst image of every two row is the original input image.
We found that most meaningful reconstructed pictures are mostly drawn from ( θ + π 4 , θ − 3 π 4 ) .
Most reconstructed images have little resemblance to the original input, and present meaningful interpolation of the original sample and the randomly chosen sample.
The result is an illustration of our k -anonymity privacy guarantee.
Fig.
8 shows images reconstructed from correctly decoded features.
The result demonstrates that, with the ‘key’ — θ , one can successfully recover original inputs from features.