Previous studies have found that an adversary attacker can often infer unintended input information from intermediate-layer features. We study the possibility of preventing such adversarial inference, yet without too much accuracy degradation. We propose a generic method to revise the neural network to boost the challenge of inferring input attributes from features, while maintaining highly accurate outputs. In particular, the method transforms real-valued features into complex-valued ones, in which the input is hidden in a randomized phase of the transformed features. The knowledge of the phase acts like a key, with which any party can easily recover the output from the processing result, but without which the party can neither recover the output nor distinguish the original input. Preliminary experiments on various datasets and network structures have shown that our method significantly diminishes the adversary's ability in inferring about the input while largely preserves the resulting accuracy.
Abstract:
In this paper, the authors propose to hide information in phase of the input features. They proposed that if each layer of processing layer, sitting outside of the local unit, is phase preserving, then they can recover the phase back. They propose a modification to the most popular layers in DNN to satisfy that property.
I think the general idea of the paper is interesting, but overall, the paper is very poorly written. It appears that it is written in a rush. 
*The abstract and introduction are poorly written. There are poorly written sentences in the text. Here are some examples:
    + "... We propose a generic method to revise a conventional neural network to boost the challenge of adversarially inferring about the input but still yields useful outputs. ...."
    + "... given a transformed feature, an adversary can at best recover a number of features which contain at least another k − 1 features which are different but cannot be distinguished from the real feature.  ..." -- This is so central to the whole paper and it is not well-written. Personally, didn't understand this attack.
Please proofread your paper.
*Why do you need both theta and b ?  It seems to me if \| b \| is comparable to \| a \|, it can destroy the information in original the a arbitrary bad, so it makes sense to keep the norm of b small. However, in the paper, it is suggested to use a random sample (I') and set b = g(I'). I don't see any ablation study in the paper. There is no free lunch, if you provide stronger identity preservation, there should be a compromise in the accuracy, and it seems to be the magnitude of the b is that compromise. 
* The whole idea of the GAN encoder is not well justified. What does it mean that the fake feature should contain information "beyond" a ? This very vague.
* "Inference attack 1 " and "Inference attack 4" are the same; only the inference models used in each attack are different. I don't know why the author has separated them.