summaries: They are proposing a meta-learning method inspired by previous method, MAML. Their idea is separating the parameters in to two groups of context and shared parameters. The context parameters are learned through back-propagation of inner-loop and represents embedding for individual task. Shared-parameters on the other hand are shared between all tasks, and are learned in the outer-loop.

summaries: CAML is a gradient-based meta-learning method closely related to MAML. It divides model parameters into disjoint sets of task-specific parameters $\phi$ which are adapted to each task and task-independent parameters $\theta$ with are meta-learned across tasks. $\phi$ are then interpreted as an embedding and fed as input to the model (parameterized by $\theta$). Experiments demonstrate that this approach performs on par with MAML while adapting far fewer parameters. An additional benefit is that this approach is less sensitive to the adaptation learning rate and is easier to implement and faster to compute.

abstractText: We propose CAML, a meta-learning method for fast adaptation that partitions the model parameters into two parts: context parameters that serve as additional input to the model and are adapted on individual tasks, and shared parameters that are meta-trained and shared across tasks. At test time, the context parameters are updated with one or several gradient steps on a task-specific loss that is backpropagated through the shared part of the network. Compared to approaches that adjust all parameters on a new task (e.g., MAML), our method can be scaled up to larger networks without overfitting on a single task, is easier to implement, and saves memory writes during training and network communication at test time for distributed machine learning systems. We show empirically that this approach outperforms MAML, is less sensitive to the task-specific learning rate, can capture meaningful task embeddings with the context parameters, and outperforms alternative partitionings of the parameter vectors.

authors:
Marcin Andrychowicz
Misha Denil
Sergio Gomez
Matthew W Hoffman
David Pfau
Tom Schaul
Brendan Shillingford
Nando De Freitas

title: Learning to learn by gradient descent by gradient descent

venue: In Advances in Neural Information Processing Systems,

authors:
Matthias Bauer
Mateo Rojas-Carulla
Jakub Bartlomiej Swikatkowski
Bernhard Scholkopf
Richard E Turner

title: Discriminative k-shot learning using probabilistic models

venue: arXiv preprint arXiv:1706.00326,

authors:
Samy Bengio
Yoshua Bengio
Jocelyn Cloutier
Jan Gecsei

title: On the optimization of a synaptic learning rule

venue: In Preprints Conf. Optimality in Artificial and Biological Neural Networks,

authors:
Jeff Donahue
Yangqing Jia
Oriol Vinyals
Judy Hoffman
Ning Zhang
Eric Tzeng
Trevor Darrell

title: Decaf: A deep convolutional activation feature for generic visual recognition

venue: In International conference on machine learning,

authors:
Chelsea Finn
Pieter Abbeel
Sergey Levine

title: Model-agnostic meta-learning for fast adaptation of deep networks

venue: arXiv preprint arXiv:1703.03400,

authors:
Chelsea Finn
Tianhe Yu
Tianhao Zhang
Pieter Abbeel
Sergey Levine

title: One-shot visual imitation learning via meta-learning

venue: arXiv preprint arXiv:1709.04905,

authors:
Chelsea Finn
Kelvin Xu
Sergey Levine

title: Probabilistic model-agnostic meta-learning

venue: arXiv preprint arXiv:1806.02817,

authors:
Spyros Gidaris
Nikos Komodakis

title: Dynamic few-shot visual learning without forgetting

venue: In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition,

authors:
Jonathan Gordon
John Bronskill
Matthias Bauer
Sebastian Nowozin
Richard E Turner

title: Decisiontheoretic meta-learning: Versatile and efficient amortization of few-shot learning

venue: arXiv preprint arXiv:1805.09921,

authors:
Erin Grant
Chelsea Finn
Sergey Levine
Trevor Darrell
Thomas Griffiths

title: Recasting gradient-based metalearning as hierarchical bayes

venue: arXiv preprint arXiv:1801.08930,

authors:
Kaiming He
Xiangyu Zhang
Shaoqing Ren
Jian Sun

title: Delving deep into rectifiers: Surpassing human-level performance on imagenet classification

venue: In Proceedings of the IEEE international conference on computer vision,

authors:
Diederik P Kingma
Jimmy Ba

title: Adam: A method for stochastic optimization

venue: arXiv preprint arXiv:1412.6980,

title: Ubernet: Training a universal convolutional neural network for low-, mid-, and high-level vision using diverse datasets and limited memory

venue: In CVPR,

authors:
Yoonho Lee
Seungjin Choi

title: Gradient-based meta-learning with learned layerwise metric and subspace

venue: In International Conference on Machine Learning,

authors:
Volodymyr Mnih
Koray Kavukcuoglu
David Silver
Andrei A Rusu
Joel Veness
Marc G Bellemare
Alex Graves
Martin Riedmiller
Andreas K Fidjeland
Georg Ostrovski

title: Human-level control through deep reinforcement learning

authors:
Alex Nichol
John Schulman

title: Reptile: a scalable metalearning algorithm

venue: arXiv preprint arXiv:1803.02999,

authors:
Boris N Oreshkin
Alexandre Lacoste
Pau Rodriguez

title: Tadam: Task dependent adaptive metric for improved few-shot learning

venue: arXiv preprint arXiv:1805.10123,

authors:
Ethan Perez
Florian Strub
Harm De Vries
Vincent Dumoulin
Aaron Courville

title: Film: Visual reasoning with a general conditioning layer

venue: arXiv preprint arXiv:1709.07871,

authors:
Siyuan Qiao
Chenxi Liu
Wei Shen
Alan L Yuille

title: Online representation learning in recurrent neural language models

venue: arXiv preprint arXiv:1508.03854,

authors:
Andrei A Rusu
Dushyant Rao
Jakub Sygnowski
Oriol Vinyals
Razvan Pascanu
Simon Osindero
Raia Hadsell

title: Meta-learning with latent embedding optimization

venue: arXiv preprint arXiv:1807.05960,

authors:
Steindór Sæmundsson
Katja Hofmann
Marc Peter Deisenroth

title: Meta reinforcement learning with latent variable gaussian processes

venue: arXiv preprint arXiv:1803.07551,

title: Evolutionary Principles in Self-referential Learning: On Learning how to Learn: the Meta-meta-meta...-hook

authors:
John Schulman
Sergey Levine
Pieter Abbeel
Michael Jordan
Philipp Moritz

title: Trust region policy optimization

authors:
Daniel L Silver
Ryan Poirier
Duane Currie

title: Inductive transfer with context-sensitive neural networks

venue: Machine Learning,

authors:
Jake Snell
Kevin Swersky
Richard Zemel

authors:
Oriol Vinyals
Charles Blundell
Tim Lillicrap
Daan Wierstra

title: Matching networks for one shot learning

authors:
Nicolai Wojke
Alex Bewley
Dietrich Paulus

title: Simple online and realtime tracking with a deep association metric

venue: In Image Processing (ICIP),

authors:
Fengwei Zhou
Bin Wu
Zhenguo Li

title: Deep meta-learning: Learning to learn in the concept space

venue: arXiv preprint arXiv:1802.03596,

heading: 1 INTRODUCTION

text:
A key challenge in meta-learning is fast adaptation: learning on previously unseen tasks fast and with little data. In principle, this can be achieved by leveraging knowledge obtained in other, related tasks. However, the best way to do so remains an open question.
A popular recent method for fast adaptation is model agnostic meta learning (MAML) (Finn et al., 2017a), which learns a model initialisation, such that at test time the model can be adapted to solve the new task in only a few gradient steps. MAML has an interleaved training procedure, comprised of inner loop and outer loop updates that operate on a batch of tasks at each iteration. In the inner loop, MAML learns task-specific parameters by performing one gradient step on a task-specific loss. Then, in the outer loop, the model parameters from before the inner loop update are updated to reduce the expected loss across tasks after the inner loop update on the individual tasks. Hence, MAML learns a model initialisation that, at test time, can generalise to a new task after only a few gradient updates.
However, while MAML adapts the entire model to the new task, many transfer learning algorithms adapt only a fraction of the model (Kokkinos, 2017), keeping the rest fixed across tasks. For example, representations learned for images can be transferred to different image classification domains (Donahue et al., 2014) or reused for object tracking in videos (Wojke et al., 2017). This suggests that some model parameters can be considered task independent and others task specific. Adapting only some model parameters can make learning faster and easier, as well as mitigate overfitting and catastrophic forgetting.
To this end, we propose context adaptation for meta-learning (CAML), a new method for fast adaptation via meta-learning. Like MAML, CAML learns a model initialisation that can quickly be adapted to new tasks. However, unlike MAML, it adapts only a subset of the model parameters to the new task. While restricting adaptation in this way is straightforward, it raises a key question: how should we decide which parameters to adapt and which to keep fixed? The main insight behind CAML is that, for many fast adaptation problems, the inner loop reduces to a task identification problem, rather than learning how to solve the whole task, which is typically infeasible with only a few gradient updates. Thus, it suffices if the part of the model that varies across tasks is an additional input to the model, and is independent of its other inputs.
These additional inputs, which we call context parameters (see Figure 1), can be interpreted as a task embedding that modulates the behaviour of the model. This embedding is learned via backpropagation during the inner loop of a meta-learning procedure similar to MAML, while the rest of the model is updated only in the outer loop. This allows CAML to explicitly optimise the task-independent parameters ✓ for good performance across tasks, while ensuring that the task-specific context parameters can quickly adapt to new tasks.
This separation of task solver and task embedding has several advantages. First, the size of both components can be chosen appropriately for the task. In particular, the network can be made expressive enough without overfitting to a single task in the inner loop, which we show empirically MAML is prone to. Model design and architecture choice also benefit from this separation, since for many practical problems we have prior knowledge of which aspects vary across tasks and hence how much capacity the context parameter should have. Like MAML, our method is model-agnostic, i.e., it can be applied to any model that is trained via gradient descent. However, CAML is easier to implement: assigning the correct computational graphs for higher order gradients is done only on the level of the context parameters, avoiding manual access and operations on the network weights and biases. Furthermore, parameter copies are not necessary which saves memory writes, a common bottleneck for running on GPUs. CAML can also help distributed machine learning systems, where the same model is deployed to different machines and we wish to learn different contexts concurrently. Network communication is often the bottleneck, which is mitigated by only sharing the (gradients of) context parameters.
We show empirically that CAML outperforms MAML on a regression and classification task and performs similarly on a reinforcement learning problem, while adapting significantly fewer parameters at test time. We observe that CAML is less sensitive to the inner-loop learning rate, and can be scaled up to larger networks without overfitting. We also demonstrate that the context parameters represent meaningful embeddings of tasks, confirming that the inner loop acts as a task identification step.

heading: 2 BACKGROUND: META-LEARNING FOR FAST ADAPTATION

text: We consider settings where the goal is to learn models that can quickly adapt to a new task with only little data. To this end, learning on the new task is preceded by meta-learning on a set of related tasks. Here we describe the meta-learning problem for supervised and reinforcement learning, as well as the method MAML.

heading: 2.1 PROBLEM SETTING

text:
In few-shot learning problems, we are given distributions over training tasks ptrain(T ) and test tasks ptest(T ). Training tasks can be used to learn how to adapt fast to any of the tasks with little per-task data, and evaluation is done on previously unseen test tasks. Unless stated otherwise, we assume that ptrain = ptest and refer to both as p. Tasks in p typically share some structure, so that transferring knowledge between tasks speeds learning. During each meta-training iteration, a batch of N tasks T = {Ti}Ni=1 is sampled from p. Supervised Learning. In a supervised learning setting, we learn a model f that maps data points x 2 X that have a true label y 2 Y to predictions ŷ 2 Y . A task Ti is defined as a tuple Ti = (X ,Y,L, q), where X is the input space, Y is the output space, L(y, ŷ) is a task-specific loss function, and q(x, y) is a distribution over labelled data points. We assume that all data points are drawn i.i.d. from q. Different tasks can be created by changing any element of Ti. Training in the supervised meta-learning setting proceeds over meta-training iterations, where for every task Ti 2 T from the current batch, we sample two datasets Dtraini (for training) and Dtesti from qTi :
Dtrain i
= {(x, y)i,m}M train i
m=1 , Dtesti = {(x, y)i,m} M
test i
m=1, (1)
where (x, y) ⇠ qTi . M traini and M testi are the number of training and test datapoints, respectively. The training data is used to update f , and the test data is then used to evaluate how good this update was, and adjust f or the update rule accordingly.
Reinforcement Learning. In a reinforcement learning (RL) setting, we aim to learn a policy ⇡ that maps states s 2 S to actions a 2 A. Each task corresponds to a Markov decision process (MDP): a tuple Ti = (S,A, r, q, q0), where S is a set of states, A is a set of actions, r(st, at, st+1) is a reward function, q(st+1|st, at) is a transition function, and q0(s0) is an initial state distribution. The goal is to maximise the expected cumulative reward J under ⇡,
J (⇡) = Eq0,q,⇡
" H 1X
t=0
t r(st, at, st+1) # , (2)
where H 2 N [1 is the horizon and 2 [0, 1] is the discount factor. Again, different tasks can be created by changing any element of Ti.
During each meta-training iteration, for every task Ti 2 T from the current batch, we first collect a trajectory ⌧
train i = {s0, a0, r0, s1, a1, r1, . . . , sM traini 1, aM traini 1, rM traini 1, sM traini } , (3) where the initial state s0 is sampled from q0, the actions are chosen by the current policy ⇡, the state transitions according to q, and M train
i is the number of environment interactions available, We unify several episodes in
this formulation: if the horizon H is reached within the trajectory, the environment is reset using q0. Once the trajectory is collected, this data is used to update the policy. Another trajectory ⌧ test
i is then collected by rolling
out the updated policy for M test i time steps. This test trajectory is used to evaluate the quality of the update on that task, and to adjust ⇡ or the update rule accordingly.
Evaluation for both supervised and reinforcement learning problems is done on a new (unseen) set of tasks drawn from p (or ptest if the test distribution of task is different). For each such task, the model is updated using L or J and only few datapoints (Dtrain or ⌧ train). Performance of the updated model is reported on Dtest or ⌧ test.

heading: 2.2 MODEL-AGNOSTIC META-LEARNING

text:
One method for few-shot learning is model-agnostic meta-learning (Finn et al., 2017a, MAML). Here, we describe the application of MAML to a supervised learning setting. MAML learns an initialisation for the parameters ✓ of a model f✓ such that, given a new task, a good model for that task can be learned with only a small number of gradient steps and data points. In the inner loop, MAML computes new task-specific parameters ✓i (starting from ✓) via one1 gradient update,
✓i = ✓ ↵r✓ 1
M i
train
X
(x,y)2Dtraini
LTi(f✓(x), y) . (4)
For the meta-update in the outer loop, the original model parameters are then updated with respect to the performance after the inner-loop update, i.e.,
✓ ✓ r✓ 1
N
X
Ti2T
1
M i test
X
(x,y)2Dtesti
LTi(f✓i(x), y) . (5)
The result of training is a model initialisation ✓ that can be adapted with just a few gradient steps to any new task that we draw from p. Since the gradient is taken with respect to the parameters ✓ before the inner-loop update (4), the outer-loop update (5) involves higher order derivatives in ✓.

heading: 3 FAST CONTEXT ADAPTATION VIA META-LEARNING

text: We propose to partition the model parameters into two parts: context parameters that are adapted in the inner loop on an individual task, and parameters ✓ that are shared across tasks and meta-learned in the outer loop. In the following we describe the training procedure for supervised and reinforcement learning problems. Pseudo-code is provided in Appendix A.

heading: 3.1 SUPERVISED LEARNING

text:
At every meta-training iteration and for the current batch T of tasks, we use the training data Dtrain i as follows. Starting from 0, which can either be fixed or meta-learned as well (we often choose 0 = 0; see Section 3.4), we learn task-specific parameters i via one gradient update:
i = 0 ↵r 1
M train i
X
(x,y)2Dtraini
LTi(f 0,✓(x), y) . (6)
While we only take the gradient with respect to , the updated parameter i is also a function of ✓, since during backpropagation, the gradients flow through the model. Once we have collected the updated parameters i for all sampled tasks, we proceed to the meta-learning step, in which ✓ is updated:
✓ ✓ r✓ 1
N
X
Ti2T
1
M test i
X
(x,y)2Dtesti
LTi(f i,✓(x), y) . (7)
This update includes higher order gradients in ✓ due to the dependency on (6). 1We outline the method for one gradient update here, but several gradient steps can be performed at this point as well.
Figure 1: Context adaptation. A network layer hl is augmented with additional context parameters (red), which are initialised to 0 before each adaptation step. The context parameters are updated by gradient descent during each inner loop and during test time. The network parameters ✓ (green) are only updated in the outer loop and shared across tasks. Hence, they stay fixed at test time. By initialising to 0, the network parameters associated with the context parameters (blue) do not affect the output of the layer before adaptation. After the first adaptation step they are used to modulate the rest of the network in order to solve the new task.

heading: 3.2 REINFORCEMENT LEARNING

text:
During each iteration, for a current batch of MDPs T = {Ti}Ni=1, we proceed as follows. Given 0 (see Section 3.4), we collect a rollout ⌧ train
i by executing the policy ⇡ 0,✓. We then compute task-specific parameters i via
one gradient update: i = 0 + ↵r J̃Ti(⌧ traini ,⇡ 0,✓), (8)
where J̃ (⌧,⇡) is an objective function given by any gradient-based reinforcement learning method that uses trajectories ⌧ produced by a parameterised policy ⇡ to update that policy’s parameters, such as TRPO (Schulman et al., 2015) or DQN (Mnih et al., 2015). After updating the policy, we collect another trajectory ⌧ test
i to evaluate
the updated policy, where actions are chosen according to the updated policy ⇡ i,✓.
After doing this for all tasks in T, we continue with the meta-update step. Here, we update the parameters ✓ to maximise the average performance across tasks (after individually updating for them),
✓ ✓ + r✓ 1
N
X
MDPi2T J̃Ti(⌧ testi ,⇡ i,✓). (9)
This update includes higher order gradients in ✓ due to the dependency on (8).

heading: 3.3 CONDITIONING ON CONTEXT PARAMETERS

text:
Since are independent of the network input, we need to decide where and how to condition the network on them. For an output node h(l)
i at a fully connected layer l, this can for example be done by simply concatenating
to the inputs to that layer:
h (l) i = g
0 @ JX
j=1
✓ (l,h) j,i h (l 1) j
+ KX
k=1
✓ (l, ) k,i 0,k + b
1
A , (10)
where g is a non-linear activation function, b is a bias parameter, ✓(l,h) j,i
are the weights associated with layer input h(l 1)
j , and ✓(l, ) k,i are the weights associated with the context parameter 0,k. This is illustrated in Figure
1. The context parameters can be added at any layer. In our experiments, we add at the first layer for fully connected networks.
Other conditioning methods can be used with CAML as well. E.g., for convolutional networks, we use the feature-wise linear modulation FiLM method (Perez et al., 2017) for image classification experiments (Section 5.2). FiLM conditions by doing an affine transformation on the feature maps: given context parameters and a convolutional layer that outputs M feature maps {hi}Mi=1, FiLM applies a linear transformation to each feature map FiLM(hi) = ihi+ , where the parameters , 2 RM are a function of the context parameters. We use a fully connected layer [ , ] = P K
k=1 ✓ (l, ) k,i
0,k+b with the identity function at the output. In our experiments, we found it helps performance to add the context parameters not at the first layer, but after a few convolutions (in our case, after the third out of four convolution operations).

heading: 3.4 CONTEXT PARAMETER INITIALISATION

text:
When learning a new task, the context parameters have to be initialised to some value, 0. We argue that, instead of meta-learning this initialisation as well, a fixed 0 is sufficient: in (10), if both ✓ (l, ) j,i
and 0 are meta-learned, the learned initialisation of can be subsumed into the bias parameter b, and 0 can be set to a fixed value. The same holds for conditioning when using FiLM layers. A key benefit of CAML is therefore that it is easy to implement, since the initialisation of the context parameters does not have to be meta-learned and parameter copies are not required. We set 0 = 0 in our implementation, which gives the additional opportunity for visual inspection of the learned context parameters (see Sections 5.1 and 5.3).

heading: 3.5 LEARNING RATE

text: Since the context parameters are inputs to the model, the gradients at this point are not backpropagated further through any other part of the model. Furthermore, because learning and ✓ is decoupled, the inner loop learning rate can effectively be meta-learned by the rest of the model. This makes the method robust to the initial learning rate that is chosen for the inner loop, as we show empirically in Sections 5.1 and 5.3.

heading: 4 RELATED WORK

text:
Meta-learning, or learning to learn, has been explored in various ways in the literature. One general approach is to learn the algorithm or update function itself (a.o., Schmidhuber (1987), Bengio et al. (1992), Andrychowicz et al. (2016), Ravi and Larochelle (2017)). Another approach is to meta-learn a model initialisation such that the model can perform well on a new task after only few gradient steps, such as MAML (Finn et al., 2017a). Other such methods are REPTILE (Nichol and Schulman, 2018) which does not require second order gradient computation and Meta-SGD (Li et al., 2017), which learns the per-parameter inner loop learning rate. Recent work (Grant et al., 2018; Finn et al., 2018) also considers Bayesian interpretations of MAML. The main difference to our work is that we consider to only adapt a small number of parameters in the inner learning loop / at test time, and that these parameters come in the form of input context parameters.
In Finn et al. (2017b) the authors augment the model with additional biases to improve the performance of MAML in a robotic manipulation setting. In contrast, we update only the context parameters in the inner loop, and initialise them to 0 before adaptation to a new task. A similar approach to ours, but in the context of neural language models, was done by Rei (2015). However, they do not consider the application of the method to the variety of domains covered by this paper (something briefly explored in the appendix of Finn et al. (2017a)).
Lee and Choi (2018) propose a framework to learn which parameters of the network to update in MAML, called MT-Nets. These learn a T-net and an M-Net. The M-net is a mask which decides which parameters to update in the inner loop, and is sampled (from a learned probability distribution) for each new task. The T-net is responsible for learning the task-specific update direction and step size. The idea of dynamic partitioning is attractive however it results in a more complex meta learning algorithm. In this work we consider a simpler, more interpretable alternative where the task-specific and shared parameters are disjoint sets.
Other meta-learning methods are also motivated by the fact that learning in a high-dimensional parameter space can pose practical difficulties, and fast adaptation in lower dimensional space is easier (e.g., Sæmundsson et al. (2018); Zhou et al. (2018)). Rusu et al. (2018) propose to learn a low-dimensional latent generative representation of (some of) the model parameters and perform gradient-based adaptation on a new task in this space, instead of the high-dimensional parameter space. Our method is similar but instead attempts to learn a latent representation of the task by backpropagating through the inner loss.
Context features as a component of inductive transfer were first introduced by Silver et al. (2008), who use a one-hot encoded task-specifying context as input to the network (which is not learned but predefined). They show that this works better than learning a shared feature extractor and having separate heads for all tasks. Learning a task embedding itself has been also explored, e.g., by Oreshkin et al. (2018), who use the task’s training set to condition the network via FiLM (Perez et al., 2017) parameters. By contrast, we learn the context parameters via backpropagation through the same network that is used to solve the task.

heading: 5 EXPERIMENTS

text: In this section we empirically evaluate CAML. Our extensive experiments aim to demonstrate three qualities of our method. First, adapting a small number of input parameters during the inner loop is sufficient to yield performance equivalent to or better than MAML in a range of regression, classification and reinforcement learning tasks. Like in MAML, it is possible to continue learning by performing several gradient update steps at test time, even when training using only one gradient step. Second, CAML is robust to the task-specific learning rate and scales well to more expressive networks without overfitting. Third, an embedding of the task emerges in the context parameters solely via backpropagation through the original inner loss. The implementation and scripts to reproduce the results are available at [blinded for review].

heading: 5.1 REGRESSION

text:
We start with the regression problem of fitting sine curves, using the same setup as Finn et al. (2017a) to allow a direct comparison. A task is defined by the amplitude and phase of the sine curve, and is generated by uniformly sampling the amplitude from [0.1, 0.5] and the phase from [0,⇡]. For training, ten labelled datapoints (uniformly sampled from x 2 [ 5, 5]) are given for each task for the inner loop update. Per meta-update we iterate over a batch of 25 tasks and perform gradient descent on a mean-squared error (MSE) loss. We use a neural network with two hidden layers and 40 nodes each and ReLU non-linearities. During testing we present the model with ten datapoints from 1000 newly sampled tasks and measure MSE over 100 test points.
CAML uses the same training procedure and architecture but adds context parameters. To allow a fair comparison, we add the same number of additional inputs to MAML, an extension that was also done by Finn et al. (2017b). These additional parameters are meta-learned together with the rest of the network, which can improve performance due to a more expressive gradient. Our method differs from this formulation in that we update only the context parameters in the inner loop, and reinitialise them to zero for each new task. In the outer loop, we only update the shared parameters.
Table 1 shows that CAML outperforms the original MAML (with no additional inputs) significantly, and MAML with the same network architecture by a small margin. This performance gain is possible even though at test time, CAML adapts only 2-5 parameters, instead of around 1600. To test the hypothesis that it suffices to adapt only input parameters per task, we also compare to alternative parameter partitions in Table 2. In parallel partitioning, we choose a strict subset of the nodes of each layer for task-specific adaptation, and meta-learn the rest. In stacked partitioning, we choose one or several layers for task-specific adaptation, and meta-learn the other layers. The results confirm that partitioning on context parameters is key to success: the other variants perform worse, often significantly so. A recent method was proposed by Lee and Choi (2018), where they also partition the network to adapt only part of it on a specific task – the partitioning mask, however, is learned. They
test their method on the regression task as well, but we outperform the numbers they report significantly (not shown, since we believe this might be due to implementational details). In the next section we will see that on few-shot classification, this approach achieves comparable performance to our method.
MAML is known to keep learning after several gradient update steps. We test this on our method as well, with the results shown in Figure 2 for up to 10 gradient steps. CAML outperforms MAML even after taking several gradient update steps, and is more stable, as indicated by the size of the confidence intervals and the monotonic learning curve.
As described in Section 3.4, CAML has the freedom to scale the gradients at the context parameters since they are inputs to the model and trained separately. Figure 4 plots the inner learning rate against the norm of the gradient of the context parameters at test time. We can see that the weights are adjusted so that lower learning rates bring about larger context parameter gradients and vice-versa. This results in the method being extremely robust to learning rates as confirmed by Figure 5. We plot the performance while varying the learning rate from 10 7 to 102. CAML is robust to changes in learning rate while MAML performs well only in a small range. Work by Li et al. (2017) shows that MAML can be improved by learning a parameter-specific learning rate, which, however, introduces a lot of additional parameters.
CAML’s performance on the regression task correlates with how many variables are needed to encode the tasks. In these experiments, two parameters vary between tasks, which is exactly the context parameter dimensionality at which CAML starts to perform well (the optimal encoding is three dimensional, as phase is periodic). This suggests CAML may indeed learn task descriptions in the context parameters. Figure 3 illustrates this by plotting the value of the learned inputs against the amplitude/phase of the task in the case of two context parameters. The model learns a smooth embedding in which interpolation between tasks is possible.

heading: 5.2 CLASSIFICATION

text:
To evaluate CAML on a more challenging problem, we test it on the competitive few-shot image classification benchmark Mini-Imagenet (Ravi and Larochelle, 2017). In N -way K-shot classification. a task is a random selection of N classes, for each of which the model gets to see K examples. From these it must learn to classify unseen images from the N classes. The Mini-Imagenet dataset consists of 64 training classes, 12 validation classes, and 24 test classes. During training, we generate a task by selecting N classes at random from the 64 classes and training the model on K examples of each, i.e., a batch of N ⇥K images. The meta-update is done on a set of unseen images of the same classes.
On this benchmark, MAML uses a network with four convolutional layers with 32 filters each and one fully connected layer at the output (Finn et al., 2017a). We use the same network architecture, but with between 32 and 512 filters per layer. We use 100 context parameters and add a FiLM layer (see Section 3.3) that conditions on these after the third convolutional layer. The parameters of the FiLM layer are meta-learned with the rest of the network, i.e., they are part of ✓. All our models were trained with two gradient steps in the inner loop and evaluated with two gradient steps (note: MAML was trained with five inner-loop gradient steps and evaluated with ten gradient steps). The inner learning rate was set to 1.0. Following Finn et al. (2017a), we ran each experiment for 60K meta-iterations and selected the model with the highest validation accuracy for evaluation on the test set.
Table 3 shows our results on Mini-Imagenet held-out test data for 5-way 1-shot and 5-shot classification. We compare to a number of existing meta-learning approaches that use convolutional neural networks, including MAML. Our largest model (512 filters) clearly outperforms MAML, and outperforms the other methods on the 1-shot classification task. On 5-shot classification, the best results are obtained by prototypical networks (Snell et al., 2017), a method that is specific to few-shot classification and works by computing distances to prototype representations of each class. Our smallest model (32 filters) under-performs MAML (within the confidence intervals). As we can see, CAML benefits from increasing model expressiveness: since we only adapt the context parameters in the inner loop per task, CAML can substantially increase the network size, without overfitting during the inner loop update. We tested scaling up MAML to a larger network size as well (see Table 3), but found that this hurt accuracy. The table only compares CAML to approaches that use conventional convolutional neural networks. Approaches that use much deeper, residual networks (e.g., Gidaris and Komodakis (2018), (Bauer et al., 2017), (Oreshkin et al., 2018), (Qiao et al., 2017)) can achieve higher accuracies. To the best of our knowledge, the LEO method by Rusu et al. (2018) is the current state of the art
with 60% and 75.7% accuracy on 1 and 5-shot respectively. Our method can be readily applied to deep residual networks as well, and we leave this exploration for future work. Table 3 also shows the first order approximation of our largest models, where the gradient with respect to ✓ is not backpropagated through the inner loop update of the context parameters . As expected, this results in a lower accuracy (a drop of 1 2%) , but we are still able to outperform MAML with a first-order version of our largest network.
Thus, CAML can achieve much higher accuracies than MAML by increasing the network size, without overfitting. Our results are obtained by only adjusting 100 parameters at test time, instead of > 30, 000 like MAML.

heading: 5.3 REINFORCEMENT LEARNING

text:
To demonstrate the versatility of CAML, we also perform preliminary reinforcement learning experiments on a 2D Navigation task, also introduced by Finn et al. (2017a). In this domain, the agent moves in a 2D world using continuous actions. At each timestep it is given a negative reward proportional to its distance from a pre-defined goal position. Each task is defined by a new unknown goal position.
We follow the same procedure as Finn et al. (2017a). Goals are sampled from an interval of (x, y) = [ 0.5, 0.5]. At each step we sample 20 tasks for both the inner and outer loops and testing is performed on 40 new unseen tasks. We perform learning for 500 iterations and the best performing policy during training is then presented with new test tasks and allowed two gradient updates. For each update, the total reward over 20 rollouts per task is measured. We use a two-layer network with 100 units per layer and ReLU non-linearities to represent the policy and a linear value function approximator. For CAML we use five context parameters at the input layer.
In terms of performance (Fgure 6a) we can see that the two methods are highly competitive. MAML performs better after the first gradient update after it is surpassed by CAML. Figure 6b, which plots performance for several learning rates, shows that CAML is again less sensitive to the inner loop learning rate. Only when using a learning rate of 0.1 is MAML competitive in performance. Furthermore, CAML adapts 5 parameters whereas MAML adapts around 10, 000 parameters.
As with regression, the optimal task embedding is low dimensional enough to plot. We therefore apply CAML with two context parameters and plot how these correlate with the actual position of the goal for 200 test tasks. Figure 6c shows that the context parameters obtained after two policy gradient updates represent a disentangled embedding of the actual task. Specifically, context parameter 1 appears to encode the y position of the goal, while context parameter 2 encodes the x position. Hence, CAML can learn compact potentially interpretable task embeddings via backpropagation through the inner loss.

heading: 6 CONCLUSION AND FUTURE WORK

text:
In this paper we introduced CAML, a meta-learning approach for fast adaptation that introduces context parameters in addition to the model’s parameters. The context parameters are used to modulate the whole network during the inner loop of meta-learning, while the rest of the network parameters are adapted in the outer loop and shared across tasks. On regression, our method outperforms MAML and is superior to naive approaches to partitioning network parameters. We also showed that CAML is highly competitive with state of the art methods on few shot classification using CNNs. In addition to this, we experimented extensively with some unique properties that specifically arise from the way that our method is formulated, such as robustness to learning rate and the emergence of task embeddings at the context parameters. Another interesting extension would be to inspect the context parameter representations learned by CAML on the Mini-Imagenet benchmark using advanced dimensionality reduction techniques.
In this paper we performed some preliminary RL experiments. We are interested in extending CAML to more challenging problems and explore its role in allowing for smart exploration in order to identify the task at hand. It would also be interesting to consider probabilistic extensions along the lines of PLATIPUS (Finn et al., 2018) where the context parameters include uncertainty about the task.
Finally, the intriguing empirical properties of CAML detailed in this work will be the base of more theoretical investigations in the future.

heading: A PSEUDO-CODE

text:
Algorithm 1 CAML for Supervised Learning Require: Distribution over tasks p(T ) Require: Step sizes ↵ and Require: Initial model f 0,✓ with ✓ initialised randomly and 0 = 0
1: while not done do 2: Sample batch of tasks T = {Ti}Ni=1 where Ti ⇠ p 3: for all Ti 2 T do 4: Dtrain
i ,Dtest i ⇠ qTi
5: 0 = 0 6: i = 0 ↵r 1
M train i
P
(x,y)2Dtraini
LTi(f 0,✓(x), y)
7: end for 8: ✓ ✓ r✓ 1N P Ti2T 1 M test i P (x,y)2Dtesti LTi(f i,✓(x, y)) 9: end while
Algorithm 2 CAML for RL Require: Distribution over tasks p(T ) Require: Step sizes ↵ and Require: Initial policy ⇡ 0,✓ with ✓ initialised randomly and 0 = 0
1: while not done do 2: Sample batch of tasks T = {Ti}Ni=1 where Ti ⇠ p 3: for all Ti 2 T do 4: Collect rollout ⌧ train
i using ⇡ 0,✓
5: i = 0 + ↵r J̃Ti(⌧ traini ,⇡ 0,✓) 6: Collect rollout ⌧ test
i using ⇡ i,✓
7: end for 8: ✓ ✓ + r✓ 1N P Ti2T J̃Ti(⌧ testi ,⇡ i,✓) 9: end while

heading: B EXPERIMENTS

text:
B.1 CLASSIFICATION
For Mini-Imagenet, our model takes as input images of size 84⇥ 84⇥ 3 and has 5 outputs, one for each class. The model has four modules that each consist of: a 2D convolution with a 3⇥3 kernel, padding 1 and 128 filters, a batch normalisation layer, a max-pooling operation with kernel size 2, if applicable a FiLM transformation (only at the third convolution, details below), and a ReLU activation function. The output size of these four blocks is 5⇥ 5⇥ 128, which we flatten to a vector and feed into one fully connected layer. The FiLM layer itself is a fully connected layer with inputs and a 256-dimensional output and the identity function at the output. The output is divided into and , each of dimension 128, which are used to transform the filters that the convolutional operation outputs. The context vector is of size 100 (other sizes tested: 50, 200) and is added after the third convolution (other versions tested: at the first, second or fourth convolution).
The network is initialised using He et al. (2015) initialisation for the weights of the convolutional and fully connected weights (including the FiLM layer weights). The bias parameters are initialised to zero, except at the FiLM layer.
We use the Adam optimiser for the meta-update step with an initial learning rate of 0.001. This learning rate is annealed every 5, 000 steps by multiplying it by 0.9. The inner learning rate is set to 0.1 (other hyperparameters tested: 1.0, 0.01).
For Mini-Imagenet, we use a meta batchsize of 4 and 2 tasks for 1-shot and 5-shot classification respectively. For the batch norm statistics, we always use the current batch – also during testing. I.e., for 5-way 1-shot classification the batch size at test time is 5, and we use this batch for normalisation.

heading: C PRACTICAL TIPS

text:
C.1 IMPLEMENTATION
The context parameters can be added to any network, and do not require direct access to the rest of the network weights like MAML. In PyTorch this can be done as follows. To add CAML parameters to a network, it is necessary to first initialise them to zero when the model is initialised:
self.context_params = torch.zeros(size=[self.num_context_params], requires_grad=True)
Add a way to reset the context parameters to zero (e.g., a method that just does the above). During the forward pass, add the context parameters to the input by concatenating it (when using a fully connected network):
x = torch.cat((x, self.context_params.expand(x.shape[0], -1)), dim=1)
(This is for fully connected networks. We refer the reader to our implementation for how to use FiLM to condition CNNs.) To correctly set the computation graph for the outer loop, it is necessary to assign the context parameters manually with their gradient. In the inner loop, compute the gradient:
grad = torch.autograd.grad(task_loss, model.context_params, create_graph=True)[0]
The option create graph will make sure that you can take the gradient of grad again. Then, update the context parameters using one gradient descent step
model.context_params = model.context_params - lr_inner * grad
If you now do another forward pass and compute the gradient of the model parameters ✓ (for the outer loop), these will include higher order gradients because grad above includes gradients of ✓, and because we kept the computation graph via the option grad. To see how to train CAML and aggregate the meta-gradient over several tasks, see our implementation at [blinded for review].
C.2 HYPERPARAMETER SELECTION
The choice of network architecture/size and context parameters can be guided by domain knowledge. E.g., for the few-shot image classification problem, an appropriate model is a deep convolutional model. For the context parameters, it is important to make sure they are not underparameterised. CAML can deal with larger than necessary context parameters (see Table 1), however, at some point it would probably overfit to the current task in the inner loop. We have not experienced this in practise though. Regarding learning rates, we suggest to start with an inner loop learning rate of 1 and the Adam optimiser (Kingma and Ba, 2014) with the standard learning rate of 0.001 for the outer loop
For CNNs, we found that adding the context parameters not at the input layer, but after several (in our case after the third out of four) convolutions works best. We believe this is because the lower-level features that the first convolutions extract are useful for any image classification task, and we only want our task embedding to influence the activations at the deeper layers. In our experiments we used a FiLM network with no hidden layers. We tried deeper versions, but this resulted in inferior performance.
We also tested to add context parameters at several layers instead of only one. However, in our experience this resulted in similar (regression and RL) or worse (in the case of CNNs) performance.


summaries: This paper proposes a privacy framework where a privatizer, according to the utility and secret specified by users, provides a sanitized version of the user data which lies in the same space as the original data, such that a utility provider can run the exact algorithm it uses for unsanitized data on the sanitized data to provide utility without sacrificing user privacy. The paper shows an information theoretic bound on the privacy loss and derives a loss function for the privatizer to use. It then proposes an algorithm for the privatizer, evaluates its performance on three scenarios.

summaries: This paper studies the problem of representing data records with potentially sensitive information about individuals in a privacy-preserving fashion such that they can be later used for training learning models. Informally, it is expected from the transformed output of data record, one should be able to learn about a desired hidden variable, but should not be able to learn anything about a sensitive hidden variable. To that end, the paper proposes a KL divergence based privacy notion, and an algorithmic approach to learn a representation while balancing the utility privacy trade-off.

abstractText: It is clear that users should own and control their data and privacy. Utility providers are also becoming more interested in guaranteeing data privacy. Therefore, users and providers can and should collaborate in privacy protecting challenges, and this paper addresses this new paradigm. We propose a framework where the user controls what characteristics of the data they want to share (utility) and what they want to keep private (secret), without necessarily asking the utility provider to change its existing machine learning algorithms. We first analyze the space of privacy-preserving representations and derive natural informationtheoretic bounds on the utility-privacy trade-off when disclosing a sanitized version of the data X . We present explicit learning architectures to learn privacypreserving representations that approach this bound in a data-driven fashion. We describe important use-case scenarios where the utility providers are willing to collaborate with the sanitization process. We study space-preserving transformations where the utility provider can use the same algorithm on original and sanitized data, a critical and novel attribute to help service providers accommodate varying privacy requirements with a single set of utility algorithms. We illustrate this framework through the implementation of three use cases; subject-withinsubject, where we tackle the problem of having a face identity detector that works only on a consenting subset of users, an important application, for example, for mobile devices activated by face recognition; gender-and-subject, where we preserve facial verification while hiding the gender attribute for users who choose to do so; and emotion-and-gender, where we hide independent variables, as is the case of hiding gender while preserving emotion detection.

authors:
Martin Bertran
Natalia Martinez
Afroditi Papadaki
Qiang Qiu
Miguel Rodrigues
Guillermo Sapiro

title: Learning to collaborate for user-controlled privacy

venue: arXiv preprint arXiv:1805.07410,

authors:
Flavio P Calmon
Ali Makhdoumi
Muriel Médard

title: Fundamental limits of perfect privacy

venue: In Information Theory (ISIT),

authors:
Qiong Cao
Li Shen
Weidi Xie
Omkar M Parkhi
Andrew Zisserman

title: VGGFace2: A dataset for recognising faces across pose and age

venue: arXiv preprint arXiv:1710.08092,

title: Xception: Deep learning with depthwise separable convolutions

venue: arXiv preprint,

title: Differential privacy: A survey of results

venue: In International Conference on Theory and Applications of Models of Computation,

authors:
Cynthia Dwork
Moni Naor

title: On the difficulties of disclosure prevention in statistical databases or the case for differential privacy

venue: Journal of Privacy and Confidentiality,

authors:
Moritz Hardt
Eric Price
Nathan Srebro

title: Equality of opportunity in supervised learning

venue: Advances in Neural Information Processing Systems (NIPS),

authors:
Salomon Israel
Avshalom Caspi
Daniel W Belsky
HonaLee Harrington
Sean Hogan
Renate Houts
Sandhya Ramrakha
Seth Sanders
Richie Poulton
Terrie E Moffitt

title: Credit scores, cardiovascular disease risk, and human capital

venue: Proceedings of the National Academy of Sciences,

authors:
Ira Kemelmacher-Shlizerman
Steven M Seitz
Daniel Miller
Evan Brossard

title: The megaface benchmark: 1 million faces for recognition at scale

title: Attacks on privacy and definetti’s theorem

venue: In Proceedings of the 2009 ACM SIGMOD International Conference on Management of data,

authors:
Daniel Kifer
Ashwin Machanavajjhala

title: No free lunch in data privacy

title: Pufferfish: A framework for mathematical privacy definitions

venue: ACM Transactions on Database Systems,

authors:
G Lample
N Zeghidour
N Usunier
A Bordes
L Denoyer
M Ranzato

title: Fader networks: Manipulating images by sliding attributes

authors:
Ziwei Liu
Ping Luo
Xiaogang Wang
Xiaoou Tang

title: Deep learning face attributes in the wild

venue: In Proceedings of International Conference on Computer Vision (ICCV),

authors:
Arvind Narayanan
Vitaly Shmatikov

title: Robust de-anonymization of large sparse datasets

venue: IEEE Symposium on Security and Privacy, pp

authors:
HW Ng
S Winkler

title: A data-driven approach to cleaning large face datasets

venue: IEEE International Conference on Image Processing (ICIP),

authors:
Seong Joon Oh
Rodrigo Benenson
Mario Fritz
Bernt Schiele

title: Faceless person recognition; Privacy implications in social media

venue: European Conference on Computer Vision (ECCV),

authors:
Aaron Reuben
Terrie E Moffitt
Avshalom Caspi
Daniel W Belsky
Honalee Harrington
Felix Schroeder
Sean Hogan
Sandhya Ramrakha
Richie Poulton
Andrea Danese

title: Lest we forget: comparing retrospective and prospective assessments of adverse childhood experiences in the prediction of adult health

venue: Journal of Child Psychology and Psychiatry,

authors:
Olaf Ronneberger
Philipp Fischer
Thomas Brox

title: U-net: Convolutional networks for biomedical image segmentation

venue: In International Conference on Medical Image Computing and Computer-Assisted Intervention,

authors:
Rasmus Rothe
Radu Timofte
Luc Van Gool

title: Deep expectation of real and apparent age from a single image without facial landmarks

venue: International Journal of Computer Vision,

authors:
Zhenyu Wu
Zhangyang Wang
Zhaowen Wang
Hailin Jin

title: Towards privacy-preserving visual recognition via adversarial training: A pilot study

venue: arXiv preprint arXiv:1807.08379,

authors:
Sergey Zagoruyko
Nikos Komodakis

title: Wide residual networks

venue: arXiv preprint arXiv:1605.07146,

heading: 1 INTRODUCTION, CHALLENGES, AND CONTRIBUTIONS

text:
Individuals are sharing vast amounts of data on a daily basis; at the same time, advances in machine learning mean that service providers that receive this user data can infer increasingly more sensitive attributes about their users. Care must be taken to provide an appropriate protection for users in order to adhere to various privacy, legal, and ethical constraints. Critical to this is the capability of finding effective privacy-preserving data representations in a data-driven manner that are able to accommodate each user’s individual needs. It is also in the interest of the utility provider to collaborate in this endeavor, the privacy-preserving data representation should account for data processing pipelines already in place. It would be impractical to tackle many of the privacy-preserving challenges today using model-based approaches, a data-driven approach is essential in allowing privatization mechanisms to keep up with new applications.
Each user should have the ability to define, sensitive and non-sensitive information associated with their data; we propose that a user and the service provider collaborate towards achieving userspecific privacy. This results in a system where the user sanitizes the data, at the sensing and/or transmitting stage without affecting the utility they need; at the same time, the provider can use the same processing pipeline for both sanitized and non-sanitized data. This is essential to ensure the service provider can accommodate several privacy requests with a single set of utility algorithms.
An example addressed by the proposed framework is to block, even at the sensor level, a device from constantly “listening.” For example, mobile devices scan images until they detect the owner, and then they open. But all images not from the owner should be private. The proposed framework
will make such devices not to understand the data until the visual or sound trigger is detected, with the capability to do this at the sensor level and without modifying the existing recognition system.
This new paradigm of collaborative privacy environment is critical since it has also been shown that algorithmic or data augmentation and unpredictable correlations can break privacy Israel et al. (2014); Narayanan & Shmatikov (2008); Oh et al. (2016); Reuben et al. (2016). The impossibility of universal privacy protection has been studied extensively in the domain of differential privacy Dwork (2008), where a number of authors have shown that assumptions about the data or the adversary must be made in order to be able to provide utility Dwork & Naor (2010); Hardt et al. (2016); Kifer & Machanavajjhala (2011; 2014). We can, however, minimize the amount of privacy we are willing to sacrifice for a given level of utility. Other recent data-driven privacy approaches like Wu et al. (2018) have also explored this notion, but do not integrate the additional collaborative constraints.
Therefore, it is important to design collaborative systems where each user shares a sanitized version of their data with the service provider in such a way that user-defined non-sensitive tasks can be performed but user-defined sensitive ones cannot, without the service provider requiring to change any data processing pipeline otherwise.
Contributions- We consider a scenario where a user wants to share a sanitized representation of data X in a way that a latent variable U can be inferred, but a sensitive latent variable S remains hidden. We formalize this notion using privacy and transparency definitions. We derive an informationtheoretic bound on privacy-preserving representations. The metrics induced by this bound are used to learn such a representation directly from data, without prior knowledge of the joint distribution of the observed data X and the latent variables U and S. This process can accommodate for several user-specific privacy requirements, and can be modified to incorporate constraints about the service provider’s existing utility inference algorithms enabling several privacy constraints to be satisfied in parallel for a given utility task.
We apply this framework to challenging use cases such as hiding gender information from a facial image (a relatively easy task) while preserving subject verification (a much harder task), or designing a sanitization function that preserves subject identification on a consenting subset of users, while disallowing it on the general population. Blocking a simpler task while preserving a harder one and blocking a device from constantly listening out-of-sample data are new applications in this work, here addressed with theoretical foundations and respecting the provider’s existing algorithms, which can simultaneously handle sanitized and non-sanitized data.
The problem statement is detailed in Section 2, and the information-theoretic bounds are derived in Section 3. Section 4 defines a trainable adversarial game that directly attempts to achieve this bound; the section also discusses how service-provider specific requirements can be incorporated. Examples of this framework are shown in Section 5. The paper is concluded in Section 6. Complementary information and proofs are presented in the Supplementary Material .

heading: 2 PROBLEM STATEMENT

text:
We describe a scenario in which we have access to possibly high-dimensional data X ∈ X , this data depends on two special latent variables U and S. U is called the utility latent variable, and is a variable we want to communicate, while S is called the secret, and is a variable we want to protect. We consider two agents, a service provider that wants to estimate U from X , and an actor that wants to infer S from X .
We define a third agent, the privatizer, that wants to learn a space-preserving stochastic mapping Q : X → Q ⊃ X in such a way that Q(X) provides information about the latent variable U , but provides relatively little information of S. In other words, we want to find a data representation that is private with respect to S and transparent with respect to U .1 We first recall the definition of privacy presented in Kifer (2009):
Definition 2.1. Privacy: Let δs be a measure of distance between probability distributions, bs ∈ R+ a positive real number, and P (S) the marginal distribution of the sensitive attribute S. The stochastic mapping Q(X) is (δs, bs)-private with respect to S if δs(P (S), P (S|Q(X))) < bs.
1Note that stochastic mappings are a natural extension of deterministic sanitization mappings. Furthermore, a deterministic mapping only truly destroys information if it is non-invertible.
We can define transparency in the same fashion:
Definition 2.2. Transparency: Let δu be a measure of distance between probability distributions, bu ∈ R+ a positive real number, and P (U |X) the posterior conditional distribution of the utility variable U after observing X . The stochastic mapping Q(X) is (δu, bu)-transparent with respect to U if δu(P (U |X), P (U |Q(X))) < bu.
Both definitions depend on the learned mapping Q; in the following section, we derive an information-theoretic bound between privacy and transparency, and show that this bound infers a particular choice of metrics δu, δs. We then show that this inferred metric can be directly implemented as a loss function to learn privatization transformations from data using standard machine learning tools.
A similar analysis of these bounds for the special case where we directly observe the utility variable U (X = U ) was analyzed in Calmon et al. (2015) in the context of the Privacy Funnel. Here, we extend this to the more general case where U is observed indirectly. More importantly, these bounds are used to design a data-driven implementation for learning privacy-preserving mappings.

heading: 3 INFORMATION-THEORETIC BOUNDS ON PRIVACY

text:
Consider the utility and secret variables U and S defined over discrete alphabets U , S,and the observed data variable X , defined over X , with joint distribution PX,U,S . Figure 1a illustrates this set-up, and shows the fundamental relationship of their entropies H(·) and mutual information.
We analyze the properties of any mapping Q : X → Q, and measure the resulting mutual information between the transformed variableQ(X) and our quantities of interest. Our goal is to findQ such that the information leakage from our sanitized data I(S;Q(X)) is minimized, while maximizing the shared information of the utility variable I(U ;Q(X)). We will later relate these quantities and the bounds here developed with the privacy/utility definitions presented in the previous section.
Maximizing I(U ;Q(X)) is equivalent to minimizing I(U ;X | Q(X)), since I(U ;X|Q(X)) = I(U ;X)− I(U ;Q(X)). The quantity I(U ;X | Q(X)) is the information X contains about U that is censured by the sanitization mapping Q.
Figure 1b illustrates I(S;Q(X)) and I(U ;X|Q(X)). One can see that there exists a trade-off area, I(U, S)− I(U, S|X), that is always included in the union of I(S;Q(X)) and I(U ;X|Q(X)). The lower we make I(S;Q(X)), the higher we make the censored information I(U ;X|Q(X)), and vice versa. This induces a lower bound over the performance of the best possible mappings Q(X) that is formalized in the following lemma.
Lemma 3.1. Let X,U, S be three discrete random variables with joint probability distribution PX,U,S . For any stochastic mapping Q : X → Q we have
I(U ;S)− I(U ;S|X) ≤ [I(S;Q(X)] + [I(U ;X|Q(X))]. (1)
Proof of this lemma is shown in Supplementary Material. To show that this bound is reachable in some instances, consider the following example. Let U and S be independent discrete random variables, and X = (U, S). The sanitization mapping Q(X) = U satisfies this bound with equality.
We can also prove, trivially, an upper bound for these quantities.
Lemma 3.2. Let X,U, S be three discrete random variables with joint probability distribution PX,U,S . For any stochastic mapping Q : X → Q we have:
I(S;Q(X)) + I(U ;X|Q(X)) ≤ I(X;U, S). (2)
That simply states that the information leakage about the secret and the censured information on the utility variable cannot exceed the total information present in the original observed variable X .

heading: 3.1 RELATION WITH PRIVACY AND TRANSPARENCY METRICS

text:
We relate the terms I(S;Q(X)) and I(U ;X | Q(X)) in Eq.1 back to our definitions of privacy and transparency.
I(U ;X | Q) = ∑ q,x p(q, x) ∑ u p(u | x, q)log [ p(u | x, q) p(u | q) ] ,
= ∑ q,x p(q, x) ∑ u p(u | x)log [ p(u | x) p(u | q) ] ,
= EX,Q [ DKL(pU |X || pU |Q) ] .
(3)
Here we used the fact that U is conditionally independent of Q given X . We then observe that Eq. 3 induces the Kullback-Leibler divergence DKL as a natural transparency metric δu in Def.2.2.
Similarly, we can analyze I(S;Q) to get,
I(S;Q) = ∑ q p(q) ∑ s p(s | q)log [ p(s | q) p(s) ] ,
= EX,Q [ RDKL(pS || pS|Q) ] .
(4)
We can see from Eq.4 that the natural induced metric for measuring privacy δs in Def,2.1 is the reverse Kullback-Leibler divergence RDKL.
We can thus rewrite our fundamental tradeoff equation as
EX,Q[RDKL(pS || pS|Q) +DKL(pU |X || pU |Q)] ≥ I(U, S)− I(U, S | X). (5)
We show next how this bound can be used to define a trainable loss metric, allowing the privatizer to select different points in the transparency-privacy trade-off space.

heading: 3.2 DEFINING A TRAINABLE LOSS METRIC

text:
Assume that for any given stochastic transformation mapping Q ∼ Q(X), we have access to the posterior conditional probability distributions P (S | Q), P (U | Q) , and P (U | X). Assume we also have access to the prior distribution of P (S). Inspired by the bounds from the previous section, the proposed privatizer loss is
minQEX,Q[(1− α)DKL(pU |X || pU |Q)2 + αRDKL(pS || pS|Q)2], (6)
where α ∈ [0, 1] is a tradeoff constant. A low α value implies a high degree of transparency, while a high value of α implies a high degree of privacy. Using Eq.5 we have a lower bound on how private or transparent the privatizer can be for any given α value, as detailed next.
Theorem 3.3. For any α ∈ [0, 1], and stochastic mapping Q : X → Q the solution to Eq.6 guarantees the following bounds,
EX,Q[DKL(pU |X || pU |Q)] ≥ α[I(U, S)− I(U, S | X)], EX,Q[RDKL(pS || pS|Q)] ≥ (1− α)[I(U, S)− I(U, S | X)].
(7)
The proof is shown in Supplementary Material. To recap, we proposed a privatizer loss Eq.6 with a controllable trade-off parameter α, and showed bounds on how transparent and private our data can be for any given value of α. Next we show how to optimize this utility-privacy formulation.

heading: 4 A DATA-DRIVEN IMPLEMENTATION

text:
Even if the joint distribution of P (U, S,X) is not known, the privatizer can attempt to directly implement Eq.6 in a data-driven architecture to find the optimalQ. Assume the privatizer has access to a dataset {(x, s, u)}, where s and u are the ground truth secret and utility values of observation x. Under these conditions, the privatizer searches for a parametric mapping q = Qθ(x, z), where z is an independent random variable, and attempts to predict the best possible attack by learning Pη(s | q), an estimator of P (s | q). The privatizer also needs Pψ(u|q) and Pφ(u|x), estimators of P (u | q) and P (u | x) respectively, to measure how much information about the utility variable is censored with the proposed mapping. Under this setup Qθ(x, z) is obtained by optimizing the following adversarial game:
η̂ = argminηEX,S,Z [ − log(Pη(s|Qθ̂(x, z)) ] ,
ψ̂ = argminψEX,U,Z [ − log(Pψ(u|Qθ̂(x, z)) ] ,
φ̂ = argminφEX,U [ − log(Pφ(u|x) ] ,
θ̂ = argminθ(1− α)E2X,U,Z [ DKL(Pφ̂(u | x) || Pψ̂(u | Qθ̂(x, z)))]+
+ αE2X,S,Z [ RDKL(P (s) || Pη̂(s | Qθ̂(x, z)))].
(8)
Here the first three terms are crossentropy loss terms to ensure our estimators Pη(s|q), Pψ(u|q), and Pφ(u|x) are a good approximation to the true posterior distributions. The final loss term attempts to find the best possible sampling function Qθ(x, z) such that (1 − α)I2(U ;X | Q) + αI2(S;Q) is minimized. Details on the algorithmic implementation are given in Section 7.3.1. Performance on simulated datasets is shown in Section 7.2.

heading: 4.1 PRIVACY UNDER FIXED UTILITY INFERENCE

text:
The proposed framework naturally provides a means to achieve collaboration from the utility provider. In this scenario, the utility provider wishes to respect the user’s desired privacy, but is unwilling to change their estimation algorithm Pφ̂(u | x), and expects the privatizer to find a mapping that minimally affects its current performance.2 This is a more challenging scenario, with worse tradeoff characteristics, in which Qθ(x, z) is obtained by optimizing
η̂ = argminηEX,S,Z [ − log(Pη(s|Qθ̂(x, z)) ] ,
θ̂ = argminθ(1− α)E2X,U,Z [ DKL(Pφ̂(u | x) || Pφ̂(u | Qθ̂(x, z)))]+
+ αE2X,S,Z [ RDKL(P (s) || Pη̂(s | Qθ̂(x, z)))].
(9)
2Recall that the utility provider wants to use the same algorithm for sanitized and non-sanitized data, a unique aspect of the proposed framework and critical to accept its collaboration.

heading: 4.2 PRIVACY UNDER FIXED UTILITY AND SECRET INFERENCE

text:
A final scenario addressed by the proposed framework arises when the utility provider is the sole agent to access the sanitized data, and it has estimation algorithms for both the utility and the privacy variable Pφ̂(u | x), Pη̂(s | x), that it is unwilling to modify. The service provider wishes to reassure the users that they are unable to infer the secret attribute from the sanitized data, if and when the user decides so. Under these conditions, we optimize for
θ̂ = argminθ(1− α)E2X,U,Z [ DKL(Pφ̂(u | x) || Pφ̂(u | Qθ̂(x, z)))]+
+ αE2X,S,Z [ RDKL(P (s) || Pη̂(s | Qθ̂(x, z)))].
(10)

heading: 5 EXPERIMENTS AND RESULTS

text: The following examples are based on the framework presented in Figure 2. Here we have the three key agents mentioned before: (1) the utility algorithm that is used by the provider to estimate the information of interest. This algorithm can take the raw data (X) or the mapped data (Q(X)) and be able to infer the utility; (2) the secret algorithm that is able to operate on the mapped data to infer the secret; (3) the privatizer that learns a space preserving mapping Q that allows the provider to learn the utility but prevents the secret algorithm to infer the secret. The utility algorithm is trained to perform well on raw data, the secret algorithm is adversarially trained to infer the secret variable after sanitization. In the next examples we show how the proposed framework performs under different scenarios, the privatizer architecture is kept unchanged across all experiments to show that the same architecture can achieve very different objectives using the proposed framework, the detailed architectures are shown in Section 7.3.2. Extra experiments under known conditions are shown in 7.2.

heading: 5.1 SUBJECT WITHIN SUBJECT

text:
We begin by analyzing the subject-within-subject problem. Imagine a subset of users wish to unlock their phone using facial identification, while others opt out of the feature; we wish the face identification service to work only on the consenting subset of users. We additionally assume that the utility provider wishes to comply with the user’s wishes, so we can apply the framework described in Section 4.2. Note that in this problem, the utility and secrecy variables are mutually exclusive.
We solve this problem by training a space-preserving stochastic mapping Q on facial image data X , where the utility and secret variable U and S are categorical variables over consenting and nonconsenting users respectively. We test this over the FaceScrub dataset Kemelmacher-Shlizerman et al. (2016), using VGGFace2 Cao et al. (2017) as the utility and secrecy inferring algorithm. The stochastic mapping was implemented using a stochastic adaptation of the UNET Ronneberger et al. (2015), architecture details are provided in Section 7.3.2.
Table 1 shows the top-5 categorical accuracy of the utility network over the sanitized data at various α points in the privacy-utility trade-off. Figure 3 show some representantive images on how images are sanitized. It also shows that the sanitization function is able to preserve information about the utility variable while effectively censoring the secret variable, even for unobserved images. A phone equipped with this filter at the sensor level would be effectively incapable of collecting information on nonconsenting users.
(a) Filtered images of consenting users (CU) (b) Filtered images of private users (PU)
Figure 3: Left and center figures show images of consenting and nonconsenting (private) users respectively, along with their sanitized counterparts. The identity of consenting users is still easily verified, while the identity of nonconsenting users is effectively censored. Table on the right shows Top-5 accuracy performance of the subject detector after sanitization across several sanitation levels α. Performance is shown across 3 subsets, consenting users (CU) are users that decided to be detected by the utility algorithm, observed private users (OPU) are those that explicitly decided to protect their privacy, while unobserved private users (UPU) are users that decided to protect their privacy but where not available during training. Consenting users are still recognized by the system, while nonconsenting users are not. For example, for α = 0.4, we significantly block OPU and UPU while preserving CU

heading: 5.2 OBFUSCATING EMOTION WHILE PRESERVING GENDER

text:
Here we continue to work on facial image data X , where utility variable U is gender recognition, and the secret variable S is emotion (smiling/non-smiling). In this scenario, variables U and S are independent. We implement this over the CelebA dataset Liu et al. (2015), using Xception networks Chollet (2017) as our utility and privacy estimators. Table.2 shows the distribution of the utility and secrecy estimators over the sanitized data. Figure 4 shows example sanitized images. It is visually possible to identify the gender of the subject but not their emotion. Most importantly, the existing gender detection algorithm still performs correctly over the sanitized images.
Figure 4: Images before and after sanitization for Gender (utility) vs Emotion (privacy).
Inference Data Male Female Gender Raw 94.2% 94.5%Sanit. 91.2% 96.1% Emotion Raw 93.3% 92.0%Sanit. 54.0% 60.0%
Table 2: Gender and emotion detection on users on raw and sanitized data.

heading: 5.3 SUBJECT PRESERVATION AND GENDER OBFUSCATION

text:
In this setup, we want to find a mapping Q that hides the gender attribute but allows subject verification. The mapping Q should prevent a standard gender detection algorithm from performing its task, while allowing a standard subject detector algorithm to still perform subject verification. This is the only experiment in this section where the secret inference algorithm is fixed.
To realize this constrained scenario, we used a WideResNet-based Zagoruyko & Komodakis (2016) implementation of DEXNet Rothe et al. (2018) as our gender detector adversary, and a ResNet50 implementation of VGGface2 Cao et al. (2017) as a subject identifier. The stochastic mapping was implemented using two differing architectures, the first is a stochastic adaptation of the UNET Ronneberger et al. (2015), and the second a concatenation of a FaderNet Lample et al. (2017) and a UNET Ronneberger et al. (2015) as shown in Bertran et al. (2018).
The mapping that incorporates a pretrained FaderNet was chosen as the baseline for the stochastic mapping function since this network is already trained to defeat a gender discriminator in its encoding space. This proves a suitable baseline comparison and starting point for a mapping function that needs to fool a gender discriminator in image space while simultaneously preserving subject verification performance. We show the performance of using only the pretrained gender FaderNet
and demonstrate how we can improve its performance by training a posterior processing mapping (UNET) using the loss proposed in Eq.10.
We tested this framework on the FaceScrub dataset Ng & Winkler (2014). Figure 5 shows how the output probabilities of the gender classification model approach the prior distribution of the dataset as α increases. We see that sanitized images produce output gender probabilities close to the dataset prior even for relatively low α values. Last column of figure 5 shows how the top-5 categorical accuracy of the subject verification task varies across different α values. These results suggest that under these conditions we can achieve almost perfect privacy while maintaining reasonable utility performance.

heading: 6 CONCLUDING REMARKS

text:
Inspired by information-theory bounds on the privacy-utility trade-off, we introduced a new paradigm where users and entities collaborate to achieve both utility and privacy per a user’s specific requirements. One salient feature of this paradigm is that it can be completely transparent – involving only the use of a simple user-specific privacy filter applied to user data – in the sense that it requires otherwise no modifications to the system infrastructure, including the service provider algorithmic capability, in order to achieve both utility and privacy.
Representative architectures and results suggest that a collaborative user-controlled privacy approach can be achieved. While the results here presented clearly show the potential of this approach, much has yet to be done, of particular note is extending this approach to continuous utility and privacy variables. While the underlying framework still holds, reliably measuring information between continuous variables is a more challenging task to perform and optimize for.
The proposed framework provides privacy metrics and bounds in expectation; we are currently investigating how the privacy tails concentrate as data is acquired and if there is a need to use information theory metrics with worst-case scenario guarantees. Modifying the information theory metrics to match some of the theoretical results in (local) differential privacy is also the subject of future research.
Privacy is closely related to fairness, transparency, and explainability, both in goals and in some of the underlying mathematics. A unified theory of these topics will be a great contribution to the ML community.

heading: 7 SUPPLEMENTARY MATERIAL

heading: 7.1 PROOFS

text:
Proof. Lemma 1
Consider the equality
I(U ;S)− I(U ;S|X) = I(S;Q(X))− I(S;Q(X)|U) + I(U ;X|Q(X))− I(U ;X|Q(X), S). (11)
We know that
0 ≤ I(S;Q(X)|U) ≤ I(S;Q(X)), 0 ≤ I(U ;X|Q(X), S) ≤ I(U ;X|Q(X)), (12)
so we can guarantee
I(U ;S)− I(U ;S|X) ≤ I(S;Q(X)) + I(U ;X|Q(X)). (13)
Proof. Theorem 3.3
Consider
AQ = EX,Q[DKL(pU |X || pU |Q)], BQ = EX,Q[DKL(pU |X || pU |Q)], K = I(U, S)− I(U, S | X),
(14)
and α ∈ [0, 1]. Minimizing Eq.6 respecting Eq.5 and Eq.12 is equivalent to solving:
minQ{(1− α)A2Q + αB2Q}, s.t.AQ, BQ ≥ 0,
AQ +BQ ≥ K, α ∈ [0, 1],
(15)
Consider the following relaxation of Eq.15
minA,B{(1− α)A2 + αB2}, s.t.A,B ≥ 0,
A+B ≥ K, α ∈ [0, 1],
(16)
where A and B are positive real values. Eq.16 is a relaxation of Eq.15 because the space of possible tuples (AQ, BQ) is included in the space of possible values of R2+
Suppose Q∗ is the solution to Eq.15, with corresponding values (AQ∗ , BQ∗), and suppose (A∗, B∗) is the solution to Eq. 16. We know
(1− α)A∗2 + αB∗2 ≤ (1− α)A2Q∗ + αB2Q∗ , (17)
Assume A∗ > AQ∗ , it follows that (1− α)AQ∗ + αB∗2 ≤ (1− α)A∗2 + αB∗2. However, AQ∗ > 0 and AQ∗ + B∗ ≤ A∗ + B∗ ≤ K. Therefore, (AQ∗ , B∗) is a valid solution to Eq.16, and is smaller than the lower bound (A∗, B∗).
This contradiction arises from assuming A∗ > AQ∗ , we thus conclude that
A∗ ≤ AQ∗ . Similarly for B∗ and BQ∗ we get
B∗ ≤ BQ∗ .
Additionally, Eq.16 is easily solvable and has solutions
A∗ = αK; B∗ = (1− α)K (18)
Consequently, we proved
EX,Q[DKL(pU |X || pU |Q)] ≥ α[I(U, S)− I(U, S | X)], EX,Q[RDKL(pS || pS|Q)] ≥ (1− α)[I(U, S)− I(U, S | X)].
(19)

heading: 7.2 EXPERIMENTS ON SIMULATED DATA

text:
The following experiments attempt to show how close to the theoretical bound shown in Eq. 5 we can get by following Algorithm 1 under known conditions.
Consider the following scenario: Utility variable U and secret variable S are two Bernoulli variables with the following joint distribution:
P (u, s) =  kρβ if (u, s) = (1, 1) (1− kρ)β if (u, s) = (0, 1) (1− kβ)ρ if (u, s) = (1, 0) 1− β − ρ+ kρβ if (u, s) = (1, 0)
(20)
where the marginal probabilities are P (U = 1) = ρ, P (S = 1) = β, and k is a parameter that controls the dependence between and S, k ∈ [0,min{ρ−1, β−1}]. For these experiments, we make both marginals equal to 0.5 (ρ = β = 0.5). Note that when k = 1, U and S are independent (I(U ;S) = 0) and when k = 0 or k = 2 they reach maximum mutual information (I(U ;S) = H(U) = H(S) = Hb(0.5) = ln(1) nats).
Our observations X will be taken in the extreme case, where X contains almost perfect information about the values of U and S. We do this by assuming that X ∈ R2 is a Gaussian Mixture Model X with the following conditional distribution:
X|U, S ∼ N( [ U S ] , σ2I2×2) (21)
We choose a low σ = 0.05; this makes it so that every pair (u, s) is mapped to almost entirely disjoint regions, therefore knowing X gives nearly perfect information about (u, s) (I(U ;X) ' H(U), I(S;X) ' H(S), I(U ;S|X) ' 0). For added simplicity, the privacy filter is linear:
Qθ(x, z) = θ × x+ z Z ∼ N( [ 0 0 ] , I2×2)
(22)
Figure 6 shows how the raw and sanitized data are distributed for varying levels of codependence k and tradeoff α for linear sanitization functions. Figure 7 shows that privacy filters optimized using Algorithm 1 learn effective privacy-preserving mappings close to the theoretical bounds, even for a simple filtering architecture. They do so without any explicit modelling of the underlying data-generating distributions, and we can achieve different tradeoff points by simply modifing the parameter α. Note that when variables U and S are perfectly independent or codependent, the linear filter is perfectly able to reach any point in the optimal bound. For intermediate cases, the linear filter was capable of reaching the bound in the region where no utility is compromised, but was not capable of following the optimal tradeoff line for higher levels of privacy.

heading: 7.3 IMPLEMENTATION DETAILS

text: Here, we explicitly elaborate on how we optimize the data-driven loss functions shown in equations 8, 9, and 10 using an adversarial approach. We first detail the exact adversarial training setup that was used to perform the experiments in Section 5, and then provide the concrete network architectures used for all shown results.

heading: 7.3.1 ALGORITHMIC IMPLEMENTATION

text:
Minimizing the objective functions in equations 8, 9, and 10, is a challenging problem in general. By focusing our attention on Eq. 8, we see that each of the four loss terms have a distinct purpose:
η̂ = argminηEX,S,Z [ − log(Pη(s|Qθ̂(x, z)) ] ,
ψ̂ = argminψEX,U,Z [ − log(Pψ(u|Qθ̂(x, z)) ] ,
φ̂ = argminφEX,U [ − log(Pφ(u|x) ] ,
θ̂ = argminθ(1− α)E2X,U,Z [ DKL(Pφ̂(u | x) || Pψ̂(u | Qθ̂(x, z)))]+
+ αE2X,S,Z [ RDKL(P (s) || Pη̂(s | Qθ̂(x, z)))].
(23)
The first three loss terms minimize a crossentropy objective for functions Pη(s | q), Pψ(u | q), and Pφ(u | x); this ensures that these functions are good estimators of the unknown true distributions of P (s | q), P (u | q), and P (u | x), where samples q are drawn from the learned sanitization mapping q = Qθ(x, z). The final loss term attempts to find the best possible sampling functionQθ(x, z) such that (1− α)I2(U ;X | Q) + αI2(S;Q) is minimized. We can approximately solve this problem by applying iterative Stochastic Gradient Descent to each of the individual loss terms with respect to their relevant parameters, this is similar to the procedure used to train Generative Adversarial Networks.
The algorithm we used to solve Eq. 8 is shown in Algorithm 1, similarly, algorithms to solve Eq. 9 and Eq. 10 are shown in Algorithm 2 and Algorithm 3 respectively.
Algorithm 1 Sanitization algorithm (θ, η, φ, ψ)← initialize network parameters
1: repeat 2: (x(1), u(1), s(1)), ...(x(b), u(b), s(b)) ∼ PX,U,S . Draw b samples from joint distribution 3: z(1), ...z(b) ∼ PZ . Draw b samples from sampling distribution 4: Φ(φ) = 1b ∑b i=1−logPφ(ui | xi) . Evaluate crossentropy loss on raw utility inference 5: φ← φ− lr∇φΦ(φ) . Stochastic gradient descent step on Pφ(u | x) 6: Ψ(ψ) = 1b ∑b i=1−logPψ(ui|Qθ(xi, zi)) . Evaluate crossentropy loss on filtered utility
inference
7: ψ ← ψ − lr∇ψΨ(ψ) . Stochastic gradient descent step on Pψ(u | q) 8: H(η) = 1b ∑b i=1−logPη(si|Qθ(xi, zi)) . Evaluate crossentropy loss on secret inference
9: η ← η − lr∇ηH(η) . Stochastic gradient descent step on Pη(s | q) 10: Θ(θ) = (1− α) [ 1 b ∑b i=1 log Pφ(u i|xi) Pψ(ui|Qθ(xi,zi)) ]2 + α [ 1 b ∑b i=1 log Pη(s i|Qθ(xi,zi))) P (si) ]2 .
Evaluate sanitation loss
11: θ ← θ − lr∇θΘ(θ) . Stochastic gradient descent step on Qθ(x, z) 12: until convergence

heading: 7.3.2 NETWORK ARCHITECTURES

text:
We now describe the exact architecture used to implement the privacy filter on all experiments shown in Section 5. Figure 8 shows the network diagram.
The architecture presented in Figure 8 is fully convolutional, so the same network definition could be used across all three experiments by varying the input layer. To speed up convergence to a good filtering solution, filters were initially trained to copy the image (under RMSE loss), and optionally infer some meaningful attribute from the input (in subject-within-subject, this attribute was a simple class label on whether the subject wished their privacy preserved). We stress that this was only done for initialization, final training of the network was done exactly as described in Algorithm 1.
Algorithm 2 Sanitization algorithm; fixed utility (θ, η)← initialize network parameters
φ← φ̂ Utility inference algorithm is fixed and known
1: repeat 2: (x(1), u(1), s(1)), ...(x(b), u(b), s(b)) ∼ PX,U,S . Draw b samples from joint distribution 3: z(1), ...z(b) ∼ PZ . Draw b samples from sampling distribution 4: H(η) = 1b ∑b i=1−logPη(si|Qθ(xi, zi)) . Evaluate crossentropy loss on secret inference 5: η ← η − lr∇ηH(η) . Stochastic gradient descent step on Pη(s | q) 6: Θ(θ) = (1− α) [ 1 b ∑b i=1 log Pφ(u i|xi) Pφ(ui|Qθ(xi,zi)) ]2 + α [ 1 b ∑b i=1 log Pη(s i|Qθ(xi,zi))) P (si) ]2 .
Evaluate sanitation loss
7: θ ← θ − lr∇θΘ(θ) . Stochastic gradient descent step on Qθ(x, z) 8: until convergence
Algorithm 3 Sanitization algorithm; fixed utility and secret θ ← initialize network parameters
φ← φ̂ Utility inference algorithm is fixed and known η ← η̂ Secret inference algorithm is fixed and known
1: repeat 2: (x(1), u(1), s(1)), ...(x(b), u(b), s(b)) ∼ PX,U,S . Draw b samples from joint distribution 3: z(1), ...z(b) ∼ PZ . Draw b samples from sampling distribution 4: Θ(θ) = (1− α) [ 1 b ∑b i=1 log Pφ(u i|xi) Pφ(ui|Qθ(xi,zi)) ]2 + α [ 1 b ∑b i=1 log Pη(s i|Qθ(xi,zi))) P (si) ]2 .
Evaluate sanitation loss
5: θ ← θ − lr∇θΘ(θ) . Stochastic gradient descent step on Qθ(x, z) 6: until convergence
The architecture of the networks used to infer the utility and secret attribute in the emotion vs. gender experiment are identical, and are shown in Figure 9.
Networks used for the experiments in Section 7.2 are shown in Figure 10.
All other networks used in the results section are implemented as described in their respective papers.