Mitigating Information Leakage in Image Representations: A Maximum Entropy Approach

By Proteek Chandan Roy, Vishnu Naresh Boddeti. 2019

119 citations recorded by the source corpus.

Image recognition systems have demonstrated tremendous progress over the past few decades thanks, in part, to our ability of learning compact and robust representations of images. As we witness the wide spread adoption of these systems, it is imperative to consider the problem of unintended leakage of information from an image representation, which might compromise the privacy of the data owner. This paper investigates the problem of learning an image representation that minimizes such leakage of user information. We formulate the problem as an adversarial non-zero sum game of finding a good embedding function with two competing goals: to retain as much task dependent discriminative image information as possible, while simultaneously minimizing the amount of information, as measured by entropy, about other sensitive attributes of the user. We analyze the stability and convergence dynamics of the proposed formulation using tools from non-linear systems theory and compare to that of the corresponding adversarial zero-sum game formulation that optimizes likelihood as a measure of information content. Numerical experiments on UCI, Extended Yale B, CIFAR-10 and CIFAR-100 datasets indicate that our proposed approach is able to learn image representations that exhibit high task performance while mitigating leakage of predefined sensitive information.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Privacy & Security

Citations in the corpus

DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks (2020, methodology): “Considerations for balancing compute feasibility and privacy has motivated private collaborative inference schemes [24, 23] that split f(θ; ·) into f1(θ1; ·) and f2(θ2; ·) where:”
NoPeek: Information leakage reduction to share activations in distributed deep learning (2020, background): “theoretic loss based privacy: These can be categorized into hiding specific sensitive attributes using adversarial training that reaches an equilibrium based on information theoretic loss functions optimized under minimax settings through learning weights of deep learning models [29, 30, 31, 32, 33,”
Privacy in Deep Learning: A Survey (2020, background): “There is a body of work studying information-theoretic based methods for both privacy and fairness, where privacy and fairness are provided through information degradation, through obfuscation or adversarial learning and demonstrated by mutual information reduction [67, 68, 48, 69, 70, 71, 72, 73, 7”
Attributing Fair Decisions with Attention Interventions (2021, methodology): “In addition to informationtheoretic approaches, we also considered baselines that use adversarial learning such as MaxEnt-ARL (Roy and Boddeti 2019), LAFTR (Madras et al. 2018), and Adversarial Forgetting (Jaiswal et al. 2020).”
Controllable Guarantees for Fair Outcomes via Contrastive Information Estimation (2021, methodology): “Roy and Boddeti (2019) strated that the representations produced were fair w.r.t to c by showing that an MLP trained to predict c from z performs poorly.”
FlowSAN: Privacy-Enhancing Semi-Adversarial Networks to Confound Arbitrary Face-Based Gender Classifiers (2019, background): “RELATED WORK With regard to privacy concerns in recent years, a new line of research has emerged that focuses on methods for imparting soft-biometric privacy to biometric data and face images in particular [8]–[10], [23], [24], [46].”
On the Global Optima of Kernelized Adversarial Representation Learning (2019, methodology): “VFAE [17] 57 85 ML-ARL [26] 57 89 MaxEnt-ARL [23] 40 89 -”
Adversarial representation learning for synthetic replacement of private attributes (2020, methodology): “In particular, Roy & Boddeti (2019) plot accuracy of an adversary predicting the sensitive attribute against the accuracy of a classiﬁer predicting the target attribute.”