Censoring Representations with an Adversary

By Harrison Edwards, Amos J. Storkey. 2015

553 citations recorded by the source corpus.

In practice, there are often explicit constraints on what representations or decisions are acceptable in an application of machine learning. For example it may be a legal requirement that a decision must not favour a particular group. Alternatively it can be that that representation of data must not have identifying information. We address these two related issues by learning flexible representations that minimize the capability of an adversarial critic. This adversary is trying to predict the relevant sensitive variable from the representation, and so minimizing the performance of the adversary ensures there is little or no information in the representation about the sensitive variable. We demonstrate this adversarial approach on two problems: making decisions free from discrimination and removing private information from images. We formulate the adversarial model as a minimax problem, and optimize that minimax objective using a stochastic gradient alternate min-max optimizer. We demonstrate the ability to provide discriminant free representations for standard test problems, and compare with previous state of the art methods for fairness, showing statistically significant improvement across most cases. The flexibility of this method is shown via a novel problem: removing annotations from images, from unaligned training examples of annotated and unannotated images, and with no a priori knowledge of the form of annotation provided to the model.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Reducing Sentiment Bias in Language Models via Counterfactual Evaluation (2019, neutral): “We aim towards counterfactual fairness by debiasing the latent representation of inputs in the language models, contributing to a family of methods to learn fair representations (Beutel et al., 2017; Zemel et al., 2013; Creager et al., 2019; Edwards and Storkey, 2016; Louizos et al., 2016) and enfor”
Towards the Science of Security and Privacy in Machine Learning (2016, background): “Edwards et al. showed that fairness could be achieved by learning in competition with an adversary trying to predict the sensitive variable from the fair model’s prediction [110].”
Does Object Recognition Work for Everyone? (2019, background): “For instance, statistical parity [5, 6, 14, 23–25, 30, 49] states that in binary-classiﬁcation settings, members of different groups should have the same chance of receiving a positive prediction.”
NIPS 2016 Tutorial: Generative Adversarial Networks (2016, neutral): “• Adversarial mechanisms for preserving privacy (Edwards and Storkey, 2015).”
Towards an Automatic Turing Test: Learning to Evaluate Dialogue Responses (2017, background): “for example, by censoring ADEM’s representations (Edwards and Storkey, 2016) such that they do not contain any information about length.”
NoPeek: Information leakage reduction to share activations in distributed deep learning (2020, background): “theoretic loss based privacy: These can be categorized into hiding specific sensitive attributes using adversarial training that reaches an equilibrium based on information theoretic loss functions optimized under minimax settings through learning weights of deep learning models [29, 30, 31, 32, 33,”
Exploiting Unintended Feature Leakage in Collaborative Learning (2018, background): “For instance, techniques that learn only the features relevant to a given task [15, 42, 43] can potentially serve as the basis for “leastprivilege” collaboratively trained models.”
Learning Adversarially Fair and Transferable Representations (2018, methodology): “…minimize its negative log likelihood (NLL - also known as cross entropy loss), given by (17) This is the formulation adopted by Ganin et al. (2016) and Edwards & Storkey (2016), which propose maximizing (17) as a proxy for computing the statistical distance ∆ ∗ ( 0 , Z 1 ) during adversarial…”
Contamination Attacks and Mitigation in Multi-Party Machine Learning (2018, neutral): “…tasks, including learning of a privacy-preserving data ﬁlter in a multi-party setting [15], learning a privacy-preserving record representation [10], while, in parallel to our work, Nasr et al. [31] use it to protect against membership privacy attacks [40], i.e., hiding whether a record was…”
Wasserstein Fair Classification (2019, background): “…representations that do not contain sensitive information during training (Beutel et al., 2017; Calders et al., 2009; Calmon et al., 2017; Edwards and Storkey, 2016; Feldman et al., 2015; Fish et al., 2015; Kamiran and Calders, 2009, 2012; Louizos et al., 2016; Zemel et al., 2013;…”
Flexibly Fair Representation Learning by Disentanglement (2019, methodology): “In this case, approaches like regularization (Zemel et al., 2013) and adversarial regularization (Edwards & Storkey, 2016; Madras et al., 2018) are straightforward to implement.”
Compositional Fairness Constraints for Graph Embeddings (2019, methodology): “This non-compositional adversary is essentially an extension of Edwards & Storkey (2015)’s approach to the graph embedding domain.”
FairGAN: Fairness-aware Generative Adversarial Networks (2018, background): “Research in [19] incorporated an adversarial model to learn a discrimination free representation.”
Causal Reasoning for Algorithmic Fairness (2018, methodology): “Demographic parity has been used, for several purposes, in the following works: [14, 19, 20, 24, 42, 43].”
Path-Specific Counterfactual Fairness (2018, methodology): “A more sophisticated approach is to pre-process the data or extract representations that do not contain information about the sensitive attribute (Zemel et al., 2013; Feldman et al., 2015; Edwards & Storkey, 2016; Louizos et al., 2016; Calmon et al., 2017).”
On Fairness and Calibration (2017, background): “However, it has been argued that Statistical Parity may not be applicable in many scenarios [7, 12, 18, 24], as it attempts to guarantee equal representation.”
On the Fairness of Disentangled Representations (2019, background): “Furthermore, there are several approaches that employ adversarial [30] training to avoid information leakage between the sensitive attributes and the representation [23, 64, 96].”