Pith. sign in

REVIEW 6 major objections 5 minor 81 references

Learning Private Representations through Entropy-based Adversarial Training

T0 review · 6 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that focal entropy — an off-centered entropy whose peak weights similar sensitive classes heavily — improves privacy sanitization, lifting CIFAR-100 target accuracy from 0.70 to 0.82 at equal adversarial accuracy.

desk verdict Good instinct, broken equivalence: the implemented loss (Eq. 10) does not match the focal entropy theory (Eq. 9), so the reported gains aren't attributable to the method as defined. read the letter →

arxiv 2507.10194 v1 pith:S75DUFVI submitted 2025-07-14 cs.LG cs.AIcs.CV

Tassilo Klein , Moin Nabi This is my paper · ORCID
classification cs.LGcs.AIcs.CV
keywords focalentropyadversarialrepresentationlearningprivacysanitizationinformationleakageoff-centeredfairdisentanglementprivacy-utilitytrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial representation learning protects privacy by making a sensitive-attribute classifier confused, but standard entropy-based confusion treats all sensitive classes alike and ignores similarity structure, which the paper claims wastes encoder capacity. The paper proposes focal entropy — an off-centered entropy whose maximum sits at a non-uniform target distribution that gives heavily re-weighted mass to the classes most similar to each input — as the adversary's objective, and argues that this sanitizes at higher target utility. Its ablation supports this: on CIFAR-100 target accuracy rises from 0.70 to 0.82 while adversarial accuracy stays at 0.16, and on CelebA adversarial identity accuracy falls from 0.061 to below 0.01 at 0.90 target accuracy. A reader should care because the change is a drop-in replacement for the adversary's loss in any entropy-based sanitization pipeline, requiring no downstream task labels, and it also improves fair-classification outcomes in the reported benchmarks.

What carries the argument

The load-bearing object is the focal-entropy objective, an off-centered entropy $\eta(p)=h(\pi^*)$ built from the piecewise-linear transform of Eq. 7, which relocates the entropy maximum from the uniform distribution $U$ to the non-uniform target $\tau$ of Eq. 6: under $\tau$, the per-input 'similar' group of $k$ nearest-neighbor sensitive classes (found by label or by a scoring function) and the 'dissimilar' complement each receive re-weighted probability mass, so each similar class carries far more weight than under uniformity. Maximizing $\eta$ is equivalent to minimizing $D_{KL}(\tilde p_S(s|z_{tar}) \| \tau)$, and the practical loss of Eq. 10 splits this into one KL-to-uniform term per group. Around this objective sits the rest of the mechanism: an encoder that splits the latent code into target and residual streams, target and sensitive predictors trained by cross-entropy on their own stream, and two adversaries trained against the opposite stream — the one on the target stream, maximizing focal entropy, is what actually sanitizes the shared representation.

What would settle it

One concrete check: after training on CIFAR-100, take a held-out batch, run the adversary on $z_{tar}$, and average the total probability mass assigned to each input's 'similar' group of 5 classes. The stated KL-to-$\tau$ objective pins that mass to $N_d/N = 0.95$; the split objective leaves it free, so a stable average clearly below that value would show the implemented loss is not the one the paper defines. A sharper test is to train two otherwise identical models, one with the KL-to-$\tau$ loss of Eq. 9 and one with the split loss of Eq. 10; measurably different adversarial-accuracy and target-accuracy pairs would show the reported ablation numbers were achieved by a different objective than the stated one.

Watch

Extended reading notes

Core claim

The paper's central claim, stated on its own terms, is that the standard entropy-based adversary — which pushes the sensitive-attribute softmax toward the uniform distribution over all $N$ classes — is a suboptimal sanitizer, and that focal entropy fixes it by being maximally ignorant about exactly the classes that matter most: those most similar to the input. Focal entropy is an off-centered entropy whose maximum is reached not at the uniform distribution but at the target $\tau$ of Eq. 6, which concentrates probability mass on the per-input 'similar' group of $k$ nearest-neighbor classes; maximizing it is equivalent to minimizing $D_{KL}(\tilde p_S(s|z_{tar}) \| \tau)$, and the authors implement it as two separate KL-to-uniform penalties run on the similar and dissimilar groups separately. The paper reports that this change alone accounts for the gains: at the same adversarial accuracy of 0.16 on CIFAR-100, target accuracy climbs from 0.70 to 0.82, and on CelebA the identity-leakage rate drops from 0.061 to below 0.01 while target attribute accuracy holds at 0.90.

Load-bearing premise

The paper's load-bearing premise is that the practical training loss — a sum of two 'push toward uniform' penalties, one for the similar group and one for the dissimilar group (Eq. 10) — is equivalent to its stated objective of driving the adversary's softmax toward the off-centered target $\tau$ (Eq. 9); that equivalence is asserted without derivation, and the two differ because Eq. 9 pins the total probability mass of each group to a fixed value while Eq. 10 leaves those masses free.

Editorial extensions

If this is right

  • On CIFAR-100, swapping standard entropy for focal entropy in the adversary raises target accuracy from 0.70 to 0.82 with no change in adversarial accuracy (0.16), so the same privacy is obtained with substantially more utility.
  • On CelebA, the swap reduces adversarial identity accuracy from 0.061 to below 0.01 while target attribute accuracy stays at 0.90 — face representations can be shared with identity leakage below one percent.
  • The focal-entropy objective strictly generalizes MaxEnt-ARL: when the similar group covers all classes, the split loss collapses to ordinary uniform entropy, so the method is an extension of the baseline rather than a separate approach.
  • In fair-classification settings (German, Adult, YaleB, UTKFace, CelebA), the same method yields leading target accuracy with fairness-violation measures comparable to or better than dedicated fair-representation methods.
  • Sanitization survives a stronger probing classifier: doubling the probe's capacity only moves CelebA adversarial accuracy from 0.007 to 0.009, supporting the claim that the representation itself — not a weak attacker — is what hides the sensitive attribute.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable reading the authors leave implicit is that the gain may come from the relaxed objective itself: the split loss of Eq. 10 does not pin the similar group's total probability mass, so the adversary is free to concentrate its confusion there — on CIFAR-100 that group is precisely the five fine-grained classes inside the input's superclass, which is where the target task must still perform.
  • Since the entropy target never names specific classes, focal entropy should transfer to zero-shot privacy, which the paper mentions only as future work: one could measure whether identity leakage stays below 1% for identities absent from training, the practical face-deployment case.
  • The hub analysis (adversarial identity-remapping graphs whose average degree falls from 13.91 to 3.0 as $k$ grows) suggests the benefit is tied to creating surjective multi-hub confusion maps; a neighbouring problem is whether the same effect appears when similarity is computed in embedding space rather than from labels, which would extend the method to text, audio, or tabular data.
  • The attribute-level result that leakage tracks attribute-identity correlation implies a cheap fairness proxy: tune $k$ and the group weighting so that per-attribute leakage is flattened, and compare against explicit mutual-information or demographic-parity bounds on the same datasets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes an adversarial representation learning method that splits the latent representation into a target stream and a residual stream, then uses a new objective called "focal entropy" to prevent sensitive attributes from being recoverable from the target stream. Focal entropy is defined as an off-centered entropy with a prescribed peak tau, and the authors claim it can be implemented by splitting the sensitive classes into "similar" and "dissimilar" groups and maximizing entropy within each group separately. The method is evaluated on CIFAR-100, CelebA, Adult, German, and YaleB for privacy and fairness, reporting improvements in the privacy-utility trade-off over MaxEnt-ARL, Kernel-SARL, ODR, and related baselines. The central assertion is that focal entropy is superior to standard entropy-based sanitization, supported by an ablation in Table 4.

Significance. The core hypothesis—that focusing the adversary's confusion on similar classes improves the privacy-utility trade-off—is interesting and, if validated, could be a useful contribution to adversarial representation learning. The paper has some strengths: it includes an explicit ablation contrasting standard entropy with focal entropy (Table 4), it attempts a stronger probing classifier on CelebA (Table 5), and it reports results across several benchmarks and fairness metrics. However, the mathematical specification of the method is internally inconsistent: the implemented objective in Eq. (10) is not equivalent to the off-centered entropy defined in Eqs. (6)-(8), the formula for tau in Eq. (6) contradicts the prose about equal probability mass, and the sign conventions in Eqs. (1), (4), and (9) conflict with the stated goal of entropy maximization. These issues mean the reported empirical gains cannot currently be attributed to the proposed focal-entropy mechanism. The lack of code, multiple seeds, or error bars further weakens the empirical support.

major comments (6)
  1. [Section 3.2, Eqs. (9)-(10)] The implementation in Eq. (10) is not equivalent to the focal-entropy objective in Eqs. (6)-(9). For N_s=5, N_d=95, take p uniform within each group with group masses 0.5/0.5; then Eq. (10) attains its minimum 0, while D_KL(p||tau) is approximately 0.83. Eq. (10) is minimized for every alpha in (0,1) when the conditional distributions inside both groups are uniform, so it has a continuum of optimizers and does not pin the total mass on "similar" classes to tau. Since the experiments in Section 4 are described as using Eq. (10), the reported gains in Table 4 cannot be attributed specifically to the off-centered entropy defined by Eqs. (6)-(8). The authors should either derive Eq. (10) from Eq. (9) under explicit assumptions, or state clearly that the optimized objective is a different group-wise entropy, and provide training curves for both objectives.
  2. [Section 3.2, Eq. (6)] Eq. (6) contradicts the prose stating that "probability mass divided equally between the two groups." With N_s=5, N_d=95, Eq. (6) gives tau_s=0.19 and tau_d about 0.000526, so the total mass on the similar group is 0.95 and on the dissimilar group is 0.05. This is not an equal split. The formula and the surrounding description need to be reconciled before the focal peak tau can be interpreted as claimed.
  3. [Section 3, Eq. (1) with Eqs. (4), (9)] The sign conventions are inconsistent with the stated goal that "adversarial predictors maximize entropy." Eq. (1) maximizes over the adversarial parameters a sum containing beta_T D_KL(p_T||U) and beta_S D_KL(p_S||tau). Maximizing D_KL(.) with respect to the adversarial parameters drives the softmax toward a deterministic distribution, i.e., away from uniformity or tau, which is the opposite of entropy maximization. If the intended update is a minimization of these divergences, the sign in Eq. (1) or the definition of phi_T/phi_S must be corrected; as written, the reader cannot determine the actual training objective used for the experiments.
  4. [Section 4, Tables 1-4] All reported accuracies are single numbers with no standard deviations, multiple seeds, or significance tests, despite the grid search over alpha, beta and per-dataset k values described in "Implementation Details." Adversarial representation learning is sensitive to initialization and hyperparameters, so the headline comparisons in Tables 1-4 (e.g., 0.70 to 0.82 on CIFAR-100 and 0.061 to below 0.01 on CelebA) are not yet established. The authors should report mean and standard deviation over at least 5 seeds and list the chosen hyperparameters for each dataset.
  5. [Section 3.2, Eq. (5) and Section 4] The definition of the similar/dissimilar partition is underspecified for every benchmark. Section 3.2 says the split can use "a) label information, or b) some scoring function obtained using a pre-trained model or on-the-fly," but the paper never states which option was used for CIFAR-100, CelebA, Adult, German, or YaleB, nor how the score r(x) is computed. Since Eq. (10) depends entirely on this partition, the experiments are not reproducible without this information. Please specify the scorer and the grouping procedure for each dataset.
  6. [Section 4.1, Table 5] The privacy evaluation relies on probing classifiers of the same family as the training adversary. The stronger probing classifier is tested only on CelebA (Table 5), not on CIFAR-100, Adult, German, or YaleB, so the robustness of the reported adversary accuracies to classifier capacity is not established for most benchmarks. Please extend the strong-probe experiment to all datasets, or qualify the privacy claims accordingly.
minor comments (5)
  1. [Section 3.2, Eq. (10)] The notation in Eq. (10), e.g., "DKL (pS(ss|ztar); theta_tar)||Us)", has misplaced semicolons and parentheses; it should read DKL(pS(ss|ztar; theta_tar)||Us).
  2. [Figure 1 caption] The caption says "The absence of clusters in private representation indicates face identities are preserved," which is confusing; it should say that identity information is not discernible or that privacy is preserved.
  3. [Section 4.1] The text says "we selected a VAE with 512 latent dimensions for ztar and ztar, respectively"; the second variable should be zres.
  4. [Section 4.1] The text refers to "Fig. 10" for the trade-off curve, but the main text labels this figure as Figure 3; figure numbering should be corrected.
  5. [Conclusion vs. Abstract] The conclusion says the approach is "largely equal to state-of-the-art approaches, occasionally superior," while the abstract claims it "outperforms state-of-the-art approaches"; these claims should be aligned.

Circularity Check

1 steps flagged · score 2.0 of 10

No circular fitting or self-citation chain; however, the implemented split objective (Eq. 10) is not the off-centered focal entropy of Eqs. 6-9, so the reported privacy-utility gains are not traceable to the paper's central definition.

  1. other [Section 3.2, Eqs. 6-10; ablation results in Table 4]
    "Implementation of the focal entropy criterion is equivalent to maximization w.r.t. an off-centered entropy [31] in the special case of normalized uniform probability within each group. ... Instead of transforming the probabilities, we can emulate this by splitting the entropy computation into two parts. ... Then training involves maximization of entropy within each subgroup separately: ϕ˜S(θE, ˜θtar) = DKL(˜pS(ss|ztar); ˜θtar)∥Us) + DKL(˜pS(sd|ztar); ˜θtar)∥Ud) (10)"

    Eqs. 6-9 define focal entropy as an off-centered entropy peaked at τ, which fixes the total mass on 'similar' classes at α = Σ_{i∈S} τ_i. Eq. 10 instead sums two within-group KL-to-uniform terms; its minimum 0 is attained for every α∈(0,1) whenever the conditional distributions inside the similar and dissimilar groups are uniform. Hence Eq. 10 has a continuum of maximizers and does not enforce the off-centered peak at τ. The objective actually optimized is therefore not the focal entropy defined in Eqs. 6-9. The reported CIFAR-100 and CelebA gains in Table 4 cannot be attributed to the paper's proposed off-centered entropy; they are produced by a different, unanalyzed objective, so the central claim is not derived from the stated definition.

full rationale

The derivation chain is largely self-contained. The adversary and probing classifiers are separate; the probing protocol follows [49,52], and Table 5 shows a stronger probe barely increases leakage (0.007 to 0.009), so the privacy metric is not simply the minimized training loss. No fitted constant is renamed as a prediction, and the self-citations (e.g., [18]) are not load-bearing. The one substantive problem is in Section 3.2: Eq. 10 is asserted to emulate the off-centered focal entropy of Eqs. 6-9, but it does not pin the group masses, so it has a continuum of optima. This makes the reported ablation gain not attributable to the defined focal entropy. That is an internal-consistency and correctness defect in the claimed derivation, not a circular fit or a self-citation chain; hence the circularity score is low.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a small number of modeling choices rather than new physical entities. The main free parameters are the k-NN size and the loss weights, both tuned per dataset. The key domain axioms are that surrogate-adversary entropy maximization approximates privacy against unknown attackers, that k-NN similarity partitioning targets the right classes, and that the VAE split can separate target and sensitive information. The off-centered entropy math is standard, cited from [31].

free parameters (3)
  • k (k-NN neighborhood size) = 5 (CIFAR-100), 16 (CelebA), equal to number of sensitive classes (other datasets)
    Determines which sensitive classes are similar in focal entropy; the supplementary shows adversary accuracy oscillates with k, so the result is sensitive to this choice.
  • trade-off weights (α_T, α_S, β_Ṱ, β_Ś) = grid-searched in [0,1] per dataset
    Weights in Eq. 1 were tuned to maximize the target/adv accuracy ratio and PD, which can inflate reported performance.
  • epochs per training phase = determined empirically by loss convergence
    Not fixed a priori, creating post-hoc selection risk.
assumptions (4)
  • domain assumption Maximizing entropy of a surrogate adversary transfers to unseen oracle classifiers
    Privacy is measured only with probing classifiers, following [49,52]; the paper acknowledges no guarantees against stronger attackers.
  • domain assumption The k-NN similar/dissimilar partition identifies classes whose confusion removes sensitive information
    No theoretical justification is given beyond hubness intuition; a wrong partition could make focal entropy equivalent to standard entropy.
  • domain assumption A VAE encoder can split target and sensitive information into separate latent streams
    Disentanglement without inductive biases is generally unidentifiable; the paper relies on the split architecture and reconstruction loss.
  • standard math Off-centered entropy properties from Lallich et al. [31] apply
    The transformation in Eq. 7 is imported from prior work without re-derivation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning Private Representations through Entropy-based Adversarial Training." pith.science (2026). https://pith.science/paper/S75DUFVI

@misc{pith2026250710194,
  author       = {Pith},
  title        = {Pith review of: Learning Private Representations through Entropy-based Adversarial Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S75DUFVI}},
  note         = {Machine review of arXiv:2507.10194}
}
read the original abstract

How can we learn a representation with high predictive power while preserving user privacy? We present an adversarial representation learning method for sanitizing sensitive content from the learned representation. Specifically, we introduce a variant of entropy - focal entropy, which mitigates the potential information leakage of the existing entropy-based approaches. We showcase feasibility on multiple benchmarks. The results suggest high target utility at moderate privacy leakage.

Figures

Figures reproduced from arXiv: 2507.10194 by the authors.

Figure 1
Figure 1. t-SNE visualization of the representation extracted from [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of focal entropy. Center: Visualization of a sample configuration; schematic focus regions depicted as circles ranging from narrow (1) to wide (3). Left: Visualization of probabilities associated with off-centering entropy (similar, dissimilar) for different focus regions scenarios. The more narrow the focus, the more weight “similar” samples have. The wider the focus range, the more equiprobability is … view at source ↗
Figure 3
Figure 3. Trade-off curve between target and adversarial accuracy [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Visualization of CelebA data and reconstructions at different privacy levels. From top to bottom, privacy revelation is decreasing. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Attribute-level privacy analysis: The normalized ∆- Accuracy and privacy trade-off on CelebA. latent representation, assuming a zero private latent vector. It can be noticed that visualizations from target latent and residual parts confirm the sanitization visually. Mo…
Figure 6
Figure 6. Figure 6: Schematic illustration of the proposed approach: The graphical model associated with the minimax game with the latent variable split up in two components. In the following sections, we add additional details omit￾ted in the main paper due to space restrictions. For cla…
Figure 7
Figure 7. Figure 7: Sanitization convergence behavior of standard entropy and focal entropy on CIFAR-100 for different classifiers: [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Left: Relationship between adversarial accuracy and the number of training epochs on CelebA. The translucent band corresponds to 50% confidence minimum and maximum adversarial accuracy, respectively. Right: Relationship between adversarial accuracy for strong (red) and…
Figure 9
Figure 9. Figure 9: Neighborhood Analysis. Relationship between adver [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: Trade-off curve between target accuracy and adversar [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: Visualization of adversary ID re-mapping graph on CelebA for entropy to focal entropy with different k-NNs on [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]
Figure 12
Figure 12. Figure 12: Visualization of CelebA identities of adversary classification network. The network (green) corresponds the [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]
Figure 13
Figure 13. Figure 13: Visualization of the remapping of IDs in CelebA due to adversarial representation learning. Source IDs (left) are remapped to [PITH_FULL_IMAGE:figures/full_fig_p019_13.png]
Figure 14
Figure 14. Figure 14: Visualization of CelebA data and reconstructions at different privacy levels. From top to bottom, privacy revelation is decreasing. [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

81 extracted references · 72 canonical work pages

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 308–318. ACM, 2016. 2

    2016

  2. [2]

    Where- fore art thou r3579x?: anonymized social networks, hidden patterns, and structural steganography

    Lars Backstrom, Cynthia Dwork, and Jon Kleinberg. Where- fore art thou r3579x?: anonymized social networks, hidden patterns, and structural steganography. In Proceedings of the 16th international conference on World Wide Web, pages 181–190. ACM, 2007. 1

    work page 2007

  3. [3]

    Solon Barocas and Andrew D. Selbst. Big Data’s Disparate Impact. SSRN eLibrary, 2014. 8

    work page 2014

  4. [4]

    Federated disentangled representation learning for unsupervised brain anomaly detection

    Cosmin I Bercea, Benedikt Wiestler, Daniel Rueckert, and Shadi Albarqouni. Federated disentangled representation learning for unsupervised brain anomaly detection. Nature Machine Intelligence, 4(8):685–695, 2022. 1

    work page 2022

  5. [5]

    Multi-level variational autoencoder: Learning disentangled representations from grouped observations

    Diane Bouchacourt, Ryota Tomioka, and Sebastian Nowozin. Multi-level variational autoencoder: Learning disentangled representations from grouped observations. In Thirty-Second AAAI Conference on Artificial Intelligence ,

    work page

  6. [6]

    Ricky T. Q. Chen, Xuechen Li, Roger Grosse, and David Duvenaud. Isolating sources of disentanglement in vaes. In Proceedings of the 32nd International Conference on Neu- ral Information Processing Systems , page 2615–2625, Red Hook, NY , USA, 2018. Curran Associates Inc. 2

    work page 2018

  7. [7]

    Flexibly fair representation learning by dis- entanglement

    Elliot Creager, David Madras, J ¨orn-Henrik Jacobsen, Marissa A Weis, Kevin Swersky, Toniann Pitassi, and Richard Zemel. Flexibly fair representation learning by dis- entanglement. arXiv preprint arXiv:1906.02589, 2019. 2, 6, 8

    arXiv 1906

  8. [8]

    Unsupervised learn- ing of disentangled representations from video

    Emily Denton and Vighnesh Birodkar. Unsupervised learn- ing of disentangled representations from video. In Proceed- ings of the 31st International Conference on Neural Informa- tion Processing Systems , page 4417–4426, Red Hook, NY , USA, 2017. Curran Associates Inc. 4

    work page 2017

Show all 81 references
  1. [9]

    Guided variational autoencoder for disentanglement learning

    Zheng Ding, Yifan Xu, Weijian Xu, Gaurav Parmar, Yang Yang, Max Welling, and Zhuowen Tu. Guided variational autoencoder for disentanglement learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7920–7929, 2020. 2, 6, 8

    2020

  2. [10]

    Im- proving zero-shot learning by mitigating the hubness prob- lem, 2014

    Georgiana Dinu, Angeliki Lazaridou, and Marco Baroni. Im- proving zero-shot learning by mitigating the hubness prob- lem, 2014. 2

    2014

  3. [11]

    Uci machine learning reposi- tory, 2017

    Dheeru Dua and Casey Graff. Uci machine learning reposi- tory, 2017. 5, 6, 8

    2017

  4. [12]

    Privacy-preserving image features via adversarial affine subspace embeddings

    Mihai Dusmanu, Johannes L Schonberger, Sudipta N Sinha, and Marc Pollefeys. Privacy-preserving image features via adversarial affine subspace embeddings. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14267–14277, 2021. 2

    2021

  5. [13]

    Differential privacy

    Cynthia Dwork. Differential privacy. In 33rd Interna- tional Colloquium on Automata, Languages and Program- ming, part II (ICALP 2006) , pages 1–12. Springer Verlag,

    2006

  6. [14]

    Exposed! a survey of attacks on private data

    Cynthia Dwork, Adam Smith, Thomas Steinke, and Jonathan Ullman. Exposed! a survey of attacks on private data. An- nual Review of Statistics and Its Application, 4:61–84, 2017. 2

    2017

  7. [15]

    Learning anonymized representa- tions with adversarial neural networks

    Cl ´ement Feutry, Pablo Piantanida, Yoshua Bengio, and Pierre Duhamel. Learning anonymized representa- tions with adversarial neural networks. arXiv preprint arXiv:1802.09386, 2018. 2

    2018 arXiv

  8. [16]

    Demystifying inter-class disentanglement

    Aviv Gabbay and Yedid Hoshen. Demystifying inter-class disentanglement. In International Conference on Learning Representations, 2020. 4

    2020

  9. [17]

    Unsupervised domain adaptation by backpropagation

    Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. arXiv preprint arXiv:1409.7495, 2014. 2

    2014 arXiv

  10. [18]

    Differentially private federated learning: A client level perspective

    Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557, 2017. 1

    2017 arXiv

  11. [19]

    Jointly de- biasing face recognition and demographic attribute estima- tion

    Sixue Gong, Xiaoming Liu, and Anil K Jain. Jointly de- biasing face recognition and demographic attribute estima- tion. In Computer Vision–ECCV 2020: 16th European Con- ference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIX 16, pages 330–347. Springer, 2020. 2

    2020

  12. [20]

    Ms-celeb-1m: A dataset and benchmark for large-scale face recognition

    Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb-1m: A dataset and benchmark for large-scale face recognition. In European Conference on Computer Vision, pages 87–102. Springer, 2016. 4, 6, 7, 8

    2016

  13. [21]

    Minimax filter: Learning to preserve privacy from inference attacks

    Jihun Hamm. Minimax filter: Learning to preserve privacy from inference attacks. The Journal of Machine Learning Research, 18(1):4704–4734, 2017. 2

    2017

  14. [22]

    Equality of op- portunity in supervised learning

    Moritz Hardt, Eric Price, and Nathan Srebro. Equality of op- portunity in supervised learning. In Proceedings of the 30th International Conference on Neural Information Processing Systems, page 3323–3331, Red Hook, NY , USA, 2016. Cur- ran Associates Inc. 8

    2016

  15. [23]

    Disentangling factors of variation with cycle- consistent variational auto-encoders

    Ananya Harsh Jha, Saket Anand, Maneesh Singh, and VSR Veeravasarapu. Disentangling factors of variation with cycle- consistent variational auto-encoders. In The European Con- ference on Computer Vision (ECCV), 2018. 4, 1

    2018

  16. [24]

    Deep Residual Learning for Image Recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. In Proceed- ings of 2016 IEEE Conference on Computer Vision and Pat- tern Recognition, pages 770–778. IEEE, 2016. 8

    2016

  17. [25]

    beta-V AE: Learning basic visual con- cepts with a constrained variational framework

    Irina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick, Shakir Mohamed, and Alexander Lerchner. beta-V AE: Learning basic visual con- cepts with a constrained variational framework. In Interna- tional Conference on Learning Representations...

    2017

  18. [26]

    Fades: Fair disentanglement with sensitive relevance

    Taeuk Jang and Xiaoqian Wang. Fades: Fair disentanglement with sensitive relevance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12067–12076, 2024. 2, 6, 8

    2024

  19. [27]

    Noisy adversarial representation learning for effective and efficient image obfuscation

    Jonghu Jeong, Minyong Cho, Philipp Benz, and Tae-hoon Kim. Noisy adversarial representation learning for effective and efficient image obfuscation. In Uncertainty in Artificial Intelligence, pages 953–962. PMLR, 2023. 2 9

    2023

  20. [28]

    Privacy-net: An adversarial ap- proach for identity-obfuscated segmentation

    Bach Ngoc Kim, Christian Desrosiers, Jose Dolz, and Pierre-Marc Jodoin. Privacy-net: An adversarial ap- proach for identity-obfuscated segmentation. arXiv preprint arXiv:1909.04087, 2019. 2

    1909 arXiv

  21. [29]

    Auto-encoding varia- tional bayes, 2013

    Diederik P Kingma and Max Welling. Auto-encoding varia- tional bayes, 2013. cite arxiv:1312.6114. 4, 5

    2013 arXiv

  22. [30]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009. 4, 6, 3

    2009

  23. [31]

    Con- struction of an off-centered entropy for supervised learning

    St ´ephane Lallich, Philippe Lenca, and Benoˆıt Vaillant. Con- struction of an off-centered entropy for supervised learning. In ASMDA 2007 : XIIth International Symposium on Applied Stochastic Models and Data Analysis, May 29 - June 1, Cha- nia, Crete, Greece, page ., Crete, G...

    2007

  24. [32]

    Deepobfuscator: Adversarial training framework for privacy-preserving image classification

    Ang Li, Jiayi Guo, Huanrui Yang, and Yiran Chen. Deepobfuscator: Adversarial training framework for privacy-preserving image classification. arXiv preprint arXiv:1909.04126, 2019. 2

    1909 arXiv

  25. [33]

    Fair representation learning: An alternative to mutual information

    Ji Liu, Zenan Li, Yuan Yao, Feng Xu, Xiaoxing Ma, Miao Xu, and Hanghang Tong. Fair representation learning: An alternative to mutual information. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , page 1088–1097, New York, NY , USA,

  26. [34]

    Fair transfer learning with factor variational auto-encoder

    Shaofan Liu, Shiliang Sun, and Jing Zhao. Fair transfer learning with factor variational auto-encoder. Neural Pro- cess. Lett., 55(3):2049–2061, 2022. 2, 6, 8

    2022

  27. [35]

    Exploring disentangled feature rep- resentation beyond face identification

    Yu Liu, Fangyin Wei, Jing Shao, Lu Sheng, Junjie Yan, and Xiaogang Wang. Exploring disentangled feature rep- resentation beyond face identification. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recogni- tion (CVPR), 2018. 4

    2018

  28. [36]

    On the fairness of disentangled representations

    Francesco Locatello, Gabriele Abbati, Thomas Rainforth, Stefan Bauer, Bernhard Sch¨olkopf, and Olivier Bachem. On the fairness of disentangled representations. In Advances in Neural Information Processing Systems , pages 14611– 14624, 2019. 2

    2019

  29. [37]

    The variational fair autoencoder

    Christos Louizos, Kevin Swersky, Yujia Li, Max Welling, and Richard Zemel. The variational fair autoencoder. arXiv preprint arXiv:1511.00830, 2015. 1

    2015 arXiv

  30. [38]

    The variational fair autoencoder, 2017

    Christos Louizos, Kevin Swersky, Yujia Li, Max Welling, and Richard Zemel. The variational fair autoencoder, 2017. 5

    2017

  31. [39]

    Learning adversarially fair and transferable represen- tations

    David Madras, Elliot Creager, Toniann Pitassi, and Richard Zemel. Learning adversarially fair and transferable represen- tations. arXiv preprint arXiv:1802.06309, 2018. 1

    2018 arXiv

  32. [40]

    Communication-efficient learning of deep networks from decentralized data

    H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et al. Communication-efficient learning of deep networks from decentralized data. arXiv preprint arXiv:1602.05629, 2016. 1

    2016 arXiv

  33. [41]

    Privacy–enhancing face biometrics: A com- prehensive survey.IEEE Transactions on Information Foren- sics and Security, 16:4147–4183, 2021

    Bla ˇz Meden, Peter Rot, Philipp Terh ¨orst, Naser Damer, Ar- jan Kuijper, Walter J Scheirer, Arun Ross, Peter Peer, and Vitomir ˇStruc. Privacy–enhancing face biometrics: A com- prehensive survey.IEEE Transactions on Information Foren- sics and Security, 16:4147–4183, 2021. 2

    2021

  34. [42]

    How to break anonymity of the netflix prize dataset

    Arvind Narayanan and Vitaly Shmatikov. How to break anonymity of the netflix prize dataset. arXiv preprint cs/0610105, 2006. 1

    2006 arXiv

  35. [43]

    Panda: Unsupervised learning of parts and appearances in the feature maps of GANs

    James Oldfield, Christos Tzelepis, Yannis Panagakis, Mi- halis Nicolaou, and Ioannis Patras. Panda: Unsupervised learning of parts and appearances in the feature maps of GANs. In The Eleventh International Conference on Learn- ing Representations, 2023. 4

    2023

  36. [44]

    Privacy-preserving deep inference for rich user data on the cloud

    Seyed Ali Osia, Ali Shahin Shamsabadi, Ali Taheri, Kleome- nis Katevas, Hamid R Rabiee, Nicholas D Lane, and Hamed Haddadi. Privacy-preserving deep inference for rich user data on the cloud. arXiv preprint arXiv:1710.01727, 2017. 1, 2

    arXiv

  37. [45]

    Deep private-feature extraction

    Seyed Ali Osia, Ali Taheri, Ali Shahin Shamsabadi, Minos Katevas, Hamed Haddadi, and Hamid RR Rabiee. Deep private-feature extraction. IEEE Transactions on Knowledge and Data Engineering, 2018. 1, 2

    2018

  38. [46]

    Learning privacy preserving encodings through adversarial training

    Francesco Pittaluga, Sanjeev Koppal, and Ayan Chakrabarti. Learning privacy preserving encodings through adversarial training. In 2019 IEEE Winter Conference on Applications of Computer Vision (WACV), pages 791–799. IEEE, 2019. 1, 2

    2019

  39. [47]

    Discovering fair representations in the data domain

    Novi Quadrianto, Viktoriia Sharmanska, and Oliver Thomas. Discovering fair representations in the data domain. In Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 8227–8236, 2019. 2

    2019

  40. [48]

    Hubs in space: Popular nearest neighbors in high- dimensional data

    Milo ˇs Radovanovi ´c, Alexandros Nanopoulos, and Mirjana Ivanovi´c. Hubs in space: Popular nearest neighbors in high- dimensional data. Journal of Machine Learning Research , 11(86):2487–2531, 2010. 2

    2010

  41. [49]

    Mitigat- ing information leakage in image representations: A maxi- mum entropy approach

    Proteek Chandan Roy and Vishnu Naresh Boddeti. Mitigat- ing information leakage in image representations: A maxi- mum entropy approach. In Proceedings of the IEEE Confer- ence on Computer Vision and Pattern Recognition, 2019. 1, 2, 4, 5, 6, 8

    2019

  42. [50]

    Privacy-preserving human activity recog- nition from extreme low resolution

    Michael S Ryoo, Brandon Rothrock, Charles Fleming, and Hyun Jong Yang. Privacy-preserving human activity recog- nition from extreme low resolution. In Thirty-First AAAI Conference on Artificial Intelligence, 2017. 2

    2017

  43. [51]

    On the global optima of kernelized adversarial representation learn- ing

    Bashir Sadeghi, Runyi Yu, and Vishnu Boddeti. On the global optima of kernelized adversarial representation learn- ing. In The IEEE International Conference on Computer Vi- sion (ICCV), 2019. 1, 2, 4, 5, 6, 8

    2019

  44. [52]

    On the global optima of kernelized adversarial representation learn- ing

    Bashir Sadeghi, Runyi Yu, and Vishnu Boddeti. On the global optima of kernelized adversarial representation learn- ing. In Proceedings of the IEEE International Conference on Computer Vision, pages 7971–7979, 2019. 5, 8, 1

    2019

  45. [53]

    Updates-leak: Data set in- ference and reconstruction attacks in online learning

    Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. Updates-leak: Data set in- ference and reconstruction attacks in online learning. arXiv preprint arXiv:1904.01067, 2019. 1

    1904 arXiv

  46. [54]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, Xi Chen, and Xi Chen. Improved techniques for training gans. In Advances in Neural Infor- mation Processing Systems . Curran Associates, Inc., 2016. 2

    2016

  47. [55]

    On the fairness of privacy-preserving rep- resentations in medical applications

    Mhd Hasan Sarhan, Nassir Navab, Abouzar Eslami, and Shadi Albarqouni. On the fairness of privacy-preserving rep- resentations in medical applications. In Domain Adaptation and Representation Transfer, and Distributed and Collabo- rative Learning: Second MICCAI Workshop, DART 2...

    2020

  48. [56]

    Share your representation only: Guar- anteed improvement of the privacy-utility tradeoff in feder- ated learning

    Zebang Shen, Jiayuan Ye, Anmin Kang, Hamed Hassani, and Reza Shokri. Share your representation only: Guar- anteed improvement of the privacy-utility tradeoff in feder- ated learning. In The Eleventh International Conference on Learning Representations, 2023. 1

    2023

  49. [57]

    Privacy-preserving deep learning

    Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC con- ference on computer and communications security , pages 1310–1321, 2015. 1

    2015

  50. [58]

    Privacy-preserving adversarial rep- resentation learning in asr: Reality or illusion? Proc

    Brij Mohan Lal Srivastava, Aur ´elien Bellet, Marc Tommasi, and Emmanuel Vincent. Privacy-preserving adversarial rep- resentation learning in asr: Reality or illusion? Proc. Inter- speech 2019, pages 3700–3704, 2019. 2

    2019

  51. [59]

    Challenges in disentangling in- dependent factors of variation, 2018

    Attila Szabo, Qiyang Hu, Tiziano Portenier, Matthias Zwicker, and Paolo Favaro. Challenges in disentangling in- dependent factors of variation, 2018. 4

    2018

  52. [60]

    Fairness-aware adver- sarial perturbation towards bias mitigation for deployed deep models

    Zhibo Wang, Xiaowei Dong, Henry Xue, Zhifei Zhang, Weifeng Chiu, Tao Wei, and Kui Ren. Fairness-aware adver- sarial perturbation towards bias mitigation for deployed deep models. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10369–10378, 2022. 8

    2022

  53. [61]

    Privacy-preserving deep action recogni- tion: An adversarial learning framework and a new dataset

    Zhenyu Wu, Haotao Wang, Zhaowen Wang, Hailin Jin, and Zhangyang Wang. Privacy-preserving deep action recogni- tion: An adversarial learning framework and a new dataset. IEEE Transactions on Pattern Analysis and Machine Intelli- gence, 2020. 5

    2020

  54. [62]

    Adversarial learning of privacy-preserving and task-oriented representations

    Taihong Xiao, Yi-Hsuan Tsai, Kihyuk Sohn, Manmohan Chandraker, and Ming-Hsuan Yang. Adversarial learning of privacy-preserving and task-oriented representations. InPro- ceedings of the AAAI Conference on Artificial Intelligence , pages 12434–12441, 2020. 2

    2020

  55. [63]

    Controllable invariance through adversarial feature learning

    Qizhe Xie, Zihang Dai, Yulun Du, Eduard Hovy, and Gra- ham Neubig. Controllable invariance through adversarial feature learning. In Advances in Neural Information Pro- cessing Systems, pages 585–596, 2017. 1, 4, 5

    2017

  56. [64]

    Investigating bias and fairness in facial expression recogni- tion

    Tian Xu, Jennifer White, Sinan Kalkan, and Hatice Gunes. Investigating bias and fairness in facial expression recogni- tion. In Computer Vision – ECCV 2020 Workshops: Glas- gow, UK, August 23–28, 2020, Proceedings, Part VI , page 506–523, Berlin, Heidelberg, 2020. Springer-Verlag. 8

    2020

  57. [65]

    Enhancing privacy in face analytics using fully homomorphic encryption

    Bharat Yalavarthi, Arjun Ramesh Kaushik, Arun Ross, Vishnu Boddeti, and Nalini Ratha. Enhancing privacy in face analytics using fully homomorphic encryption. In 2024 IEEE 18th International Conference on Automatic Face and Gesture Recognition (FG), pages 1–9, 2024. 1

    2024

  58. [66]

    The extended yale face database b

    Yale. The extended yale face database b. 2001. 5

    2001

  59. [67]

    Learning informative and private representations via generative adversarial networks

    Tsung-Yen Yang, Christopher Brinton, Prateek Mittal, Mung Chiang, and Andrew Lan. Learning informative and private representations via generative adversarial networks. In 2018 IEEE International Conference on Big Data (Big Data) , pages 1534–1543. IEEE, 2018. 2

    2018

  60. [68]

    Kitani, and Yoichi Sato

    Ryo Yonetani, Vishnu Naresh Boddeti, Kris M. Kitani, and Yoichi Sato. Privacy-preserving visual learning using dou- bly permuted homomorphic encryption. 2017 IEEE Interna- tional Conference on Computer Vision (ICCV), pages 2059– 2069, 2017. 1

    2017

  61. [69]

    Boosting demographic fairness of face attribute classifiers via latent adversarial representations

    Huimin Zeng, Zhenrui Yue, Lanyu Shang, Yang Zhang, and Dong Wang. Boosting demographic fairness of face attribute classifiers via latent adversarial representations. In 2022 IEEE International Conference on Big Data (Big Data) , pages 1588–1593, 2022. 8

    2022

  62. [70]

    # !!"# !$%! Residual Target Enc Dec

    Zhifei Zhang, Yang Song, and Hairong Qi. Age progres- sion/regression by conditional adversarial autoencoder. In IEEE Conference on Computer Vision and Pattern Recogni- tion (CVPR). IEEE, 2017. 6, 8 11 Learning Private Representations through Entropy-based Adversarial Training...

    2017

  63. [72]

    shortcuts

    Sanitization Convergence Behaviour This section explores the behavior of standard entropy and the proposed focal entropy for sanitization. Fig. 7 de- picts the classification performance during the training of different classifiers involved in the minimax optimization scheme: ...

  64. [73]

    Analysis on Neighborhood Size: We study the effect of varying k on focal entropy and the associated adversary accuracy. See Fig. 9 for a visualization of this relationship on the CelebA dataset. As can be seen, the adversary accuracy has oscillatory behavior with various local...

  65. [74]

    We thereby largely follow the pro- tocol of [23, 52]

    Probing Analysis with Strong Classifier This section provides more detail on assessing the classi- fier’s strength in terms of privacy leakage and the depen- dence on training time. We thereby largely follow the pro- tocol of [23, 52]. Specifically, we employed a stronger post...

  66. [75]

    one-to-one

    Hub Analysis This section provides an analysis of how the application of focal entropy, with its integration of the notion of k−NN, promotes the formation of “hubs”. By varying the neigh- borhood size k, focal entropy manifests itself between two extremes: i) Choosing a small ...

  67. [76]

    Visualization of Hub Faces To study hubs’ semantics, we visualize the CelebA iden- tities of the network corresponding to focal entropy with k−nearest neighborhood size k = 5 . See Fig. 12 for the visualization of the hub faces. As can be seen, the hubs exhibit a rich diversit...

  68. [77]

    This visu- alization provides a more in-depth view of how the adver- sarial process leads to a remapping of identities

    Adversarial Identity Mapping Figure 13 is a zoom-in version of a graph shown in the main paper, with k−nearest neighborhood size k = 5. This visu- alization provides a more in-depth view of how the adver- sarial process leads to a remapping of identities. To avoid visual clutt...

  69. [78]

    relatively unbiased

    Attribute-level Analysis We extend the results from the main paper by reporting de- tailed results of the normalized ∆-Accuracy and privacy trade-off on all the attributes in CelebA dataset (Tab. 7). While in the paper, we only reported the results on the sub- set of the attri...

  70. [79]

    Trade-off Curve In this section, we provide a zoom-in version of the trade- off figure in the paper, which shows the results in the in the region of interest, and compares it with several competitors

  71. [80]

    Each column is two different samples from CelebA (one male and one female), and from top to bot- tom, the privacy disclosure is decreasing for each

    Qualitative Results Figure 14 shows different reconstructions of additional CelebA identities (equal male and female) at different pri- vacy levels. Each column is two different samples from CelebA (one male and one female), and from top to bot- tom, the privacy disclosure is ...

  72. [81]

    Ta- ble 10 shows the architectures of the V AE, i.e., the encoder and the decoder

    Architectural Details We describe the architecture of each part of our model. Ta- ble 10 shows the architectures of the V AE, i.e., the encoder and the decoder. It should be noted that the last two layers of the encoder in Tab. 8 arise from layer splitting to accom- modate for...

  73. [2022]

    Association for Computing Machinery. 2, 6, 8

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.