Pith. sign in

REVIEW 3 major objections 4 minor 64 references

PASS: Private Attributes Protection with Stochastic Data Substitution

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PASS claims that stochastic substitution—replacing each input with another sample drawn from a learned distribution—can suppress private attributes to the guessing baseline even against a fresh classifier trained on the obfuscated data.

desk verdict Useful probing-attack result and a genuinely different method, but the cleanest privacy claim (AudioMNIST gender NAG=0) is internally inconsistent with the ID result and likely reflects a weak probing classifier rather than robust protection. read the letter →

arxiv 2506.07308 v2 pith:KZFVLTXN submitted 2025-06-08 cs.LG stat.ML

Yizhuo Chen , Chun-Fu (Richard) Chen , Hsiang Hsu , Shaohan Hu , Tarek Abdelzaher This is my paper
classification cs.LGstat.ML
keywords privateattributeprotectionstochasticdatasubstitutionprobingattackmutualinformationadversarialtrainingvulnerabilityutility-preservingobfuscationlocaldifferentialprivacyNormalizedAccuracyGain
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that private attributes can be removed from shared data more reliably by stochastic substitution than by adversarial training. PASS replaces each input sample $x$ with another sample $x'$ drawn from a fixed substitute pool according to a learned probability $P_\theta(X'|X)$, trained so that the obfuscated data carries little mutual information with private attributes $S_i$ while preserving useful attributes $U_j$ and general features. The paper's central empirical claim is that under a Probing Attack—an attacker with access to the trained obfuscation model and training set who trains a fresh classifier on the obfuscated data—PASS drives the Normalized Accuracy Gain (NAG) to 0 for gender on AudioMNIST and for gender and ID on Motion Sense, and to 4.9 for Male on CelebA, with mean NAG (mNAG) far above six adversarial-training baselines. If true, this gives a plug-in obfuscation module for voice, sensor, and image pipelines that does not presuppose a particular adversary.

What carries the argument

The central object is the stochastic substitution probability $P_\theta(X'=x'|X=x)=\frac{\exp(\cos(f(x),g(x'))/\tau)}{\sum_{x''\in\mathcal D_{\mathrm{substitute}}}\exp(\cos(f(x),g(x''))/\tau)}$, which measures how strongly an input embedding $f(x)$ matches candidate substitute embeddings $g(x')$; lower temperature sharpens the choice. This kernel is what carries the argument: its entropy spreads each input over substitutes with different private-attribute values, suppressing $S_i$, while its concentration around substitutes with matching useful attributes preserves $U_j$ and general features. The loss decomposes into $\hat L_{S_i}$ from $H(X'|S_i)$, $\hat L_{U_j}$ from $\log|U_j|\,\mathbb E[-\log P(U'_j=U_j|X)]$, and $\hat L_X$ from $H(X'|X)$, with the mini-batch expectation of their combination upper-bounding the information-theoretic objective. Under assumptions spelled out in the appendix, the same substitution kernel also acts as a local differential privacy mechanism, specifically a high-dimensional extension of randomized response.

What would settle it

Train PASS on a dataset with a well-separated private attribute, then let an attacker train a much larger probing classifier on the full set of obfuscated training samples with more epochs and multiple initializations; the central privacy claim fails if private-attribute NAG rises substantially above 0 or accuracy rises above the majority baseline. As a direct mathematical check, compute the gap $\mathbb E[\hat L]+C-L$ on the trained model using the corrected constant: if the gap is large and does not shrink during training, the surrogate loss's connection to the stated mutual-information objective is not established.

Watch

Extended reading notes

Core claim

The paper's central claim is that the weakness of prior private-attribute protection methods is structural: their adversarial classifiers estimate only a lower bound on $I(X';S_i)$, leaving residual information that a stronger or differently trained classifier can exploit. PASS avoids adversarial training by treating obfuscation as a stochastic substitution kernel $P_\theta(X'|X)$ over a substitute dataset, and training that kernel with a surrogate loss $\hat L$ derived from $L=\sum_i I(X';S_i)-\lambda\sum_j I(X';U_j)-\mu I(X';X)$. Theorem 4.1 asserts that the expected mini-batch surrogate loss upper-bounds $L$ up to a parameter-independent constant, so minimizing $\hat L$ targets the mutual-information objective; Theorem 4.2 bounds useful-attribute and general-feature information by private-attribute information, quantifying the unavoidable utility cost when attributes are entangled. The empirical evaluations on AudioMNIST, Motion Sense, and CelebA report private-attribute NAG at or near 0 under the Probing Attack, while useful and hidden useful attributes remain largely inferable.

Load-bearing premise

The load-bearing premise is that minimizing the surrogate loss $\hat L$ drives the true mutual information $I(X';S_i)$ to near zero; the paper proves only $\mathbb E[\hat L]+C\ge L$ with an uncontrolled gap, and the stated theorem's condition and constant require correction ($\mu\le M$, not $\mu\le N$, and $C=(M-\mu)\log|\mathcal D_{\mathrm{substitute}}|-\lambda\sum_j H(U_j)+\lambda N$). A second load-bearing premise is that releasing real samples from the substitute pool is an acceptable privacy release, since those samples still carry the pool users' private attributes.

Editorial extensions

If this is right

  • Private-attribute obfuscation no longer depends on training a specific adversarial classifier, so the defender's guarantee is not tied to the adversary present during training.
  • An attacker with the trained model API and the training data who trains a fresh classifier on the obfuscated outputs still cannot infer suppressed attributes beyond the majority-guessing baseline.
  • Downstream classifiers trained on original data can be applied directly to PASS-obfuscated data, so the method can be inserted into existing pipelines without retraining the downstream model.
  • The privacy–utility trade-off is controllable through $\lambda$ and $\mu$, and the utility cost of entangled attributes can be estimated ahead of time from $H(U|S_i)$, $C(U)$, and $H(X|S_i)$.
  • Under the local differential privacy interpretation, PASS provides a high-dimensional randomized-response mechanism, so the protection is a property of the substitution kernel rather than of any particular classifier.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the substitute pool members are not protected: the released obfuscated data are real samples from those users, still carrying their private attributes, so a deployment would need synthetic substitutes or an additional privacy layer for the pool.
  • The same embedding-plus-cosine-substitution mechanism should transfer to text, tabular, or other modalities once a suitable encoder is chosen; the paper demonstrates voice, sensor, and image inputs only.
  • The Probing Attack evaluation protocol could become a standard stress test for attribute-obfuscation methods, since it is simple, needs no knowledge of the defender's training protocol, and directly challenges the usual adversarial-training assumption.
  • A testable extension is to construct the substitute pool with balanced private-attribute classes rather than random sampling, and to test whether this tightens the achieved NAG further or improves the privacy–utility frontier.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes PASS, a stochastic data substitution method for suppressing private attributes while preserving useful attributes and general features. Instead of adversarial training, PASS replaces each input sample with another sample from a substitution pool according to a learned softmax distribution, trained to minimize a surrogate loss derived from an information-theoretic objective L = Σ I(X';Si) - λ Σ I(X';Uj) - μ I(X';X). The paper proves an upper-bound relationship between the surrogate loss and L (Theorem 4.1), analyzes entangled attributes (Theorem 4.2), and evaluates PASS on AudioMNIST, Motion Sense, and CelebA against six adversarial baselines plus several DP baselines, using the Probing Attack protocol and NAG/mNAG metrics.

Significance. The core idea is novel and potentially valuable: replacing adversarial training with stochastic substitution is a clean way to avoid the known 'unseen stronger adversary' failure mode, and the paper's evaluation is unusually careful in several respects (three modalities, three seeds, standard errors, fresh attacker classifiers, ablations on λ, μ, pool size, and pool distribution). If the claims held, PASS would be a strong practical contribution to utility-preserving private attribute protection. However, the theoretical guarantee as stated is algebraically incorrect, and the headline AudioMNIST privacy result is internally inconsistent with the reported preservation of speaker ID; both issues bear directly on the paper's central claim.

major comments (3)
  1. [§4.2, Theorem 4.1, Appendix D.2] Theorem 4.1 as stated is not algebraically correct. In the Appendix D.2 derivation, the coefficient of H(X') in L is (M-μ), so bounding H(X') by log|Dsubstitute| is valid only when μ ≤ M, not μ ≤ N. The constant must also be C = (M-μ)log|Dsubstitute| - λ Σ_j H(Uj) + λN, not C = (M-μ)log|Dsubstitute| - λ Σ_j H(Uj) + λ. In addition, the theorem only establishes E[\hat L] + C ≥ L, which is an upper bound on L; without a matching lower bound or an analysis of the gap, the statement that minimizing \hat L 'can lead to the minimization of L' overstates what is proved.
  2. [§5.2, Tables 2 and 7] The AudioMNIST gender result is internally inconsistent with the reported ID preservation. PASS achieves gender accuracy 79.9% against an 80.0% majority baseline (NAG 0.0), while the same obfuscated data yield ID accuracy 49.8% (NAG 49.7). Since speaker ID deterministically determines gender in AudioMNIST, an attacker who first predicts the ID and then reads off that speaker's gender achieves about 49.8% + 50.2% × 80.0% ≈ 89.9% gender accuracy, far above the guessing baseline. This shows that the direct gender classifier used in the Probing Attack is not a strong adversary and that the NAG=0.0 result does not establish privacy under the paper's own threat model. The authors should evaluate this composed attack (or an equivalent adaptive attacker) and revise the privacy claim accordingly.
  3. [Algorithm 2, §4.3] PASS outputs an unmodified real sample drawn from Dsubstitute, which is a random subset of the training data. In any deployment scenario where the recipient does not already possess the training set, the private attributes of the substitute users are disclosed verbatim in the released data. The paper does not discuss consent, synthetic substitutes, or anonymization of the substitution pool, and the Impact Statement asserts there is 'no ethical concern.' This is a load-bearing limitation of the privacy guarantee and needs to be addressed explicitly.
minor comments (4)
  1. [§5.1, Eq. (14)] The mNAG formula has the index roles swapped: the useful-attribute average should divide by N+K (the number of useful and hidden useful attributes), and the private-attribute average should divide by M (the number of private attributes). As written, the formula is undefined for the Motion Sense experiments, where M=2 and N=1.
  2. [§1] There is a typo in the method name: 'Stochatsic data Substitution' should be 'Stochastic data Substitution.'
  3. [§3.2] The statement that NAG is 'generally proportional to the accuracy of a classifier' is imprecise; NAG is an affine function of accuracy after clipping at zero and at the no-suppression upper bound.
  4. [§4.5 and Appendix B] The LDP interpretation is interesting but is stated under 'certain assumptions' that are never made fully explicit; the authors should state the exact conditions under which PASS is an (ε,δ)-LDP mechanism.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the loss is derived from an explicit information-theoretic objective and validated on held-out data with fresh attacker classifiers.

full rationale

The paper's loss derivation begins from an explicit objective L = Σ_i I(X';S_i) − λ Σ_j I(X';U_j) − μI(X';X). The surrogate L̂ is derived via entropy bounds and mini-batch estimates; Theorem 4.1 only claims E[L̂]+C ≥ L, so the surrogate is not equivalent to the measured metric by construction. Empirical NAG results are evaluated with attacker classifiers trained from scratch on obfuscated data and measured on held-out test data; raw accuracies are also reported. The adoption of SUIFT and NAG from prior work with overlapping authors is a metric/protocol choice, not a load-bearing derivation. There are non-circular correctness issues (e.g., Theorem 4.1's constant and condition appear misstated), but no reduction of the prediction to its inputs.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The central claim rests on a small set of domain assumptions (deterministic attributes, finite categorical supports), standard information-theoretic inequalities (Fano, Pinsker, data processing), and heuristic hyperparameter choices (lambda, mu, tau, pool size). The mini-batch bias is handled by converting the exact objective into a surrogate upper bound rather than an unbiased estimate. No new physical or mathematical entities are introduced; the 'almighty attacker' in Appendix B is a theoretical worst-case construct, not an asserted entity.

free parameters (5)
  • lambda (utility weight) = N/M by rule (e.g., 1 for single useful attribute tasks)
    Trade-off coefficient between private attribute suppression and useful attribute preservation in Equation 1; selected by heuristic, ablation study shows stability across 0.1N/M to 5N/M.
  • mu (general feature weight) = 0.2N
    Coefficient for the general feature preservation term mu*I(X';X); selected by heuristic, ablated from 0 to 0.5N.
  • tau (softmax temperature) = 0.01
    Temperature of the softmax in Equation 2, fixed for all experiments; hand-chosen.
  • substitution pool size |Dsubstitute| = 4096
    Size of the substitution pool sampled from the training set; ablated from 1024 to 24000 with stable results.
  • backbone and embedding dimensions = FaceNet for images, 3-layer MLP for audio, 6-layer CNN for sensor data, 512-dim embeddings
    Experimental configuration choices, specified in Table 6; not fitted to test data.
assumptions (6)
  • domain assumption Each attribute is deterministic given X: P(Si|X) and P(Uj|X) are degenerate
    Stated in Section 3.1; used to derive P(X'|Si) = E_{Pdata(X|Si)}[Ptheta(X'|X)] and equalities such as H(X'|X,Si)=H(X'|X).
  • domain assumption Attributes follow finite categorical distributions
    Stated in Section 3.1, following Bertran et al. (2019); ensures finite mutual information and cardinality-based bounds.
  • standard math Fano's inequality with binary entropy bounded by 1 and Jensen's inequality
    Used in Appendix D.2 to bound H(Uj|X') - 1 by the surrogate utility loss; standard results cited to Cover (1999).
  • standard math Pinsker's inequality
    Used in Appendix B to convert KL bounds into local differential privacy guarantees for the almighty attacker model.
  • domain assumption The attacker in the LDP analysis knows the exact posterior P(Si|X') (almighty attacker)
    Assumed in Appendix B to define the inference algorithm A(x); this is a worst-case theoretical construct, not assumed in the empirical probing attack.
  • domain assumption Mini-batch independence: conditioning on the batch index B does not change H(X'|X) and the utility estimates are unbiased
    Required in Appendix D.2 for the claim that E_B[Lhat] upper-bounds the objective; holds when X' is sampled independently given X.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PASS: Private Attributes Protection with Stochastic Data Substitution." pith.science (2026). https://pith.science/paper/KZFVLTXN

@misc{pith2026250607308,
  author       = {Pith},
  title        = {Pith review of: PASS: Private Attributes Protection with Stochastic Data Substitution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KZFVLTXN}},
  note         = {Machine review of arXiv:2506.07308}
}
read the original abstract

The growing Machine Learning (ML) services require extensive collections of user data, which may inadvertently include people's private information irrelevant to the services. Various studies have been proposed to protect private attributes by removing them from the data while maintaining the utilities of the data for downstream tasks. Nevertheless, as we theoretically and empirically show in the paper, these methods reveal severe vulnerability because of a common weakness rooted in their adversarial training based strategies. To overcome this limitation, we propose a novel approach, PASS, designed to stochastically substitute the original sample with another one according to certain probabilities, which is trained with a novel loss function soundly derived from information-theoretic objective defined for utility-preserving private attributes protection. The comprehensive evaluation of PASS on various datasets of different modalities, including facial images, human activity sensory signals, and voice recording datasets, substantiates PASS's effectiveness and generalizability.

Figures

Figures reproduced from arXiv: 2506.07308 by the authors.

Figure 1
Figure 1. An intuitive and slightly simplified comic illustration of the motivation behind PASS. (1) A user enjoys sharing data (e.g., selfies) but wants to keep certain private attributes (e.g., being orange) protected. (2) State-of-the-art methods based on adversarial training can be ineffective against stronger adversaries. (3) PASS uses stochastic data substitution to make private attributes unpredictable for stronger adv… view at source ↗
Figure 2
Figure 2. An illustration use case of PASS applied on facial images. We suppress ”sex” as a private attribute, and preserve ”Eyeglasses” and ”Smiling” as useful attributes. Apart from these attributes, we also preserve general features in facial images, such as ”Black hair” and ”Young”, which are not explicitly annotated in the dataset, but are useful for potential downstream applications. PASS stochasti￾cally substitutes the… view at source ↗
Figure 3
Figure 3. The probabilistic model of all random variables. U, S, X′ are only dependent on X. from the audio clip, while preserving the spoken content. Invariance of sample space dictating that the obfuscated data should remain in the same space as the original data, ensuring the seamless insertion of our method into existing pipelines and data re-usability, which is adopted in most of the recent works (Bertran et al., 2019; D… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The overview of PASS design. PASS stochastically replaces each original sample x with a substitute sample x ′ according to probability Pθ(X ′ = x ′ |X = x). Pθ(X ′ = x ′ |X = x) is used to calculate approximate loss functions LˆSi , LˆUj and LˆX, which are theoreticall…
Figure 5
Figure 5. Figure 5: The confusion matrices of the stochastic data substitution results of PASS. The confusion matrices are calculated for the experiment shown in [PITH_FULL_IMAGE:figures/full_fig_p022_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

64 extracted references · 47 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    B., Mironov, I., Talwar, K., and Zhang, L

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp.\ 308--318, 2016

    work page 2016

  3. [3]

    M., El Ammari, A., and Hammami, H

    Ahmed, S., Alshater, M. M., El Ammari, A., and Hammami, H. Artificial intelligence and machine learning in finance: A bibliometric review. Research in International Business and Finance, 61: 0 101646, 2022

    work page 2022

  4. [4]

    A., Fischer, I., Dillon, J

    Alemi, A. A., Fischer, I., Dillon, J. V., and Murphy, K. Deep variational information bottleneck. In International Conference on Learning Representations, 2017. URL https://openreview.net/forum?id=HyxQzBceg

    work page 2017

  5. [5]

    Arachchige, P. C. M., Bertok, P., Khalil, I., Liu, D., Camtepe, S., and Atiquzzaman, M. Local differential privacy for deep learning. IEEE Internet of Things Journal, 7 0 (7): 0 5827--5842, 2019

    2019

  6. [6]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pp.\ 274--283. PMLR, 2018

    work page 2018

  7. [7]

    Interpreting and explaining deep neural networks for classification of audio signals

    Becker, S., Ackermann, M., Lapuschkin, S., M \"u ller, K.-R., and Samek, W. Interpreting and explaining deep neural networks for classification of audio signals. arXiv preprint arXiv:1807.03418, 2018

    arXiv 2018

  8. [8]

    Adversarially learned representations for information obfuscation and inference

    Bertran, M., Martinez, N., Papadaki, A., Qiu, Q., Rodrigues, M., Reeves, G., and Sapiro, G. Adversarially learned representations for information obfuscation and inference. In International Conference on Machine Learning, pp.\ 614--623. PMLR, 2019

    work page 2019

Show all 64 references
  1. [9]

    A review of privacy-preserving techniques for deep learning

    Boulemtafes, A., Derhab, A., and Challal, Y. A review of privacy-preserving techniques for deep learning. Neurocomputing, 384: 0 21--45, 2020

    2020

  2. [10]

    Swin-unet: Unet-like pure transformer for medical image segmentation

    Cao, H., Wang, Y., Chen, J., Jiang, D., Zhang, X., Tian, Q., and Wang, M. Swin-unet: Unet-like pure transformer for medical image segmentation. In European conference on computer vision, pp.\ 205--218. Springer, 2022

    2022

  3. [11]

    and Wagner, D

    Carlini, N. and Wagner, D. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp.\ 39--57. Ieee, 2017

    2017

  4. [12]

    On evaluating adversarial robustness

    Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Goodfellow, I., Madry, A., and Kurakin, A. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019

    1902 arXiv

  5. [13]

    Membership inference attacks from first principles

    Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramer, F. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pp.\ 1897--1914. IEEE, 2022

    2022

  6. [14]

    and Haas, C

    Caton, S. and Haas, C. Fairness in machine learning: A survey. ACM Computing Surveys, 56 0 (7): 0 1--38, 2024

    2024

  7. [15]

    and Mukerjee, R

    Chaudhuri, A. and Mukerjee, R. Randomized response: Theory and techniques. Routledge, 2020

    2020

  8. [16]

    A simple framework for contrastive learning of visual representations

    Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp.\ 1597--1607. PMLR, 2020

    2020

  9. [17]

    Chen, Y., Chen, C.-F., Hsu, H., Hu, S., Pistoia, M., and Abdelzaher, T. F. Mass: Multi-attribute selective suppression for utility-preserving data transformation from an information-theoretic perspective. In International Conference on Machine Learning, pp.\ 6519--6538. PMLR, 2024

    2024

  10. [18]

    Cover, T. M. Elements of information theory. John Wiley & Sons, 1999

    1999

  11. [19]

    R., Chen, C., and Shah, M

    Dave, I. R., Chen, C., and Shah, M. Spact: Self-supervised privacy preservation for action recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 20164--20173, 2022

    2022

  12. [20]

    Calibrating noise to sensitivity in private data analysis

    Dwork, C., McSherry, F., Nissim, K., and Smith, A. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference, pp.\ 265--284. Springer, 2006

    2006

  13. [21]

    The algorithmic foundations of differential privacy

    Dwork, C., Roth, A., et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

    2014

  14. [22]

    and Storkey, A

    Edwards, H. and Storkey, A. Censoring representations with an adversary. In International Conference on Learning Representations, 2016

    2016

  15. [23]

    Image pixelization with differential privacy

    Fan, L. Image pixelization with differential privacy. In IFIP Annual Conference on Data and Applications Security and Privacy, pp.\ 148--162. Springer, 2018

    2018

  16. [24]

    Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems, 33: 0 16937--16947, 2020

    Geiping, J., Bauermeister, H., Dr \"o ge, H., and Moeller, M. Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems, 33: 0 16937--16947, 2020

    2020

  17. [25]

    D., Fedorov, A., Lavoie-Marchildon, S., Grewal, K., Bachman, P., Trischler, A., and Bengio, Y

    Hjelm, R. D., Fedorov, A., Lavoie-Marchildon, S., Grewal, K., Bachman, P., Trischler, A., and Bengio, Y. Learning deep representations by mutual information estimation and maximization. In International Conference on Learning Representations, 2019. URL https://openreview.net/f...

    2019

  18. [26]

    H., Lakhotia, K., Salakhutdinov, R., and Mohamed, A

    Hsu, W.-N., Bolte, B., Tsai, Y.-H. H., Lakhotia, K., Salakhutdinov, R., and Mohamed, A. Hubert: Self-supervised speech representation learning by masked prediction of hidden units. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 29: 0 3451--3460, 2021

    2021

  19. [27]

    Generative adversarial privacy

    Huang, C., Kairouz, P., Chen, X., Sankar, L., and Rajagopal, R. Generative adversarial privacy. arXiv preprint arXiv:1807.05306, 2018

    2018 arXiv

  20. [28]

    Evaluating gradient inversion attacks and defenses in federated learning

    Huang, Y., Gupta, S., Song, Z., Li, K., and Arora, S. Evaluating gradient inversion attacks and defenses in federated learning. Advances in neural information processing systems, 34: 0 7232--7241, 2021

    2021

  21. [29]

    Adversarial examples are not bugs, they are features

    Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019

    2019

  22. [30]

    and Gong, N

    Jia, J. and Gong, N. Z. \ AttriGuard \ : A practical defense against attribute inference attacks via adversarial machine learning. In 27th USENIX Security Symposium (USENIX Security 18), pp.\ 513--529, 2018

    2018

  23. [31]

    Let it snow: Adding pixel noise to protect the user’s identity

    John, B., Liu, A., Xia, L., Koppal, S., and Jain, E. Let it snow: Adding pixel noise to protect the user’s identity. In ACM Symposium on Eye Tracking Research and Applications, pp.\ 1--3, 2020

    2020

  24. [32]

    P., Lee, H

    Kasiviswanathan, S. P., Lee, H. K., Nissim, K., Raskhodnikova, S., and Smith, A. What can we learn privately? SIAM Journal on Computing, 40 0 (3): 0 793--826, 2011

    2011

  25. [33]

    Automatic speech recognition using advanced deep learning approaches: A survey

    Kheddar, H., Hemis, M., and Himeur, Y. Automatic speech recognition using advanced deep learning approaches: A survey. Information Fusion, pp.\ 102422, 2024

    2024

  26. [34]

    Kumar, P., Chauhan, S., and Awasthi, L. K. Artificial intelligence in healthcare: review, ethics, trust challenges & future research directions. Engineering Applications of Artificial Intelligence, 120: 0 105894, 2023

    2023

  27. [35]

    and Nagahara, H

    Kumawat, S. and Nagahara, H. Privacy-preserving action recognition via motion difference quantization. In European Conference on Computer Vision, pp.\ 518--534. Springer, 2022

    2022

  28. [36]

    t-closeness: Privacy beyond k-anonymity and l-diversity

    Li, N., Li, T., and Venkatasubramanian, S. t-closeness: Privacy beyond k-anonymity and l-diversity. In 2007 IEEE 23rd international conference on data engineering, pp.\ 106--115. IEEE, 2006

    2007

  29. [37]

    Deep learning face attributes in the wild

    Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

    2015

  30. [38]

    and Hutter, F

    Loshchilov, I. and Hutter, F. Decoupled weight decay regularization. In International Conference on Learning Representations, 2019. URL https://openreview.net/forum?id=Bkg6RiCqY7

    2019

  31. [39]

    Learning adversarially fair and transferable representations

    Madras, D., Creager, E., Pitassi, T., and Zemel, R. Learning adversarially fair and transferable representations. In International Conference on Machine Learning, pp.\ 3384--3393. PMLR, 2018

    2018

  32. [40]

    and Lee, S

    Majeed, A. and Lee, S. Anonymization techniques for privacy preserving data publishing: A comprehensive survey. IEEE access, 9: 0 8512--8545, 2020

    2020

  33. [41]

    From the information bottleneck to the privacy funnel

    Makhdoumi, A., Salamatian, S., Fawaz, N., and M \'e dard, M. From the information bottleneck to the privacy funnel. In 2014 IEEE Information Theory Workshop (ITW 2014), pp.\ 501--505. IEEE, 2014

    2014

  34. [42]

    G., Cavallaro, A., and Haddadi, H

    Malekzadeh, M., Clegg, R. G., Cavallaro, A., and Haddadi, H. Mobile sensor data anonymization. In Proceedings of the international conference on internet of things design and implementation, pp.\ 49--58, 2019

    2019

  35. [43]

    M., Javed, A., Irtaza, A., and Malik, H

    Masood, M., Nawaz, M., Malik, K. M., Javed, A., Irtaza, A., and Malik, H. Deepfakes generation and detection: State-of-the-art, open challenges, countermeasures, and way forward. Applied intelligence, 53 0 (4): 0 3974--4026, 2023

    2023

  36. [44]

    Oord, A. v. d., Li, Y., and Vinyals, O. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748, 2018

    2018 arXiv

  37. [45]

    Big data set privacy preserving through sensitive attribute-based grouping

    Qu, Y., Yu, S., Gao, L., and Niu, J. Big data set privacy preserving through sensitive attribute-based grouping. In 2017 IEEE International Conference on Communications (ICC), pp.\ 1--6. IEEE, 2017

    2017

  38. [46]

    Rajendran, K., Jayabalan, M., and Rana, M. E. A study on k-anonymity, l-diversity, and t-closeness techniques. IJCSNS, 17 0 (12): 0 172, 2017

    2017

  39. [47]

    U-net: Convolutional networks for biomedical image segmentation

    Ronneberger, O., Fischer, P., and Brox, T. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assisted Intervention--MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18, ...

    2015

  40. [48]

    Roy, P. C. and Boddeti, V. N. Mitigating information leakage in image representations: A maximum entropy approach. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 2586--2594, 2019

    2019

  41. [49]

    and Sweeney, L

    Samarati, P. and Sweeney, L. Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression. 1998

    1998

  42. [50]

    H., Navab, N., Eslami, A., and Albarqouni, S

    Sarhan, M. H., Navab, N., Eslami, A., and Albarqouni, S. Fairness by learning orthogonal disentangled representations. In Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part XXIX 16, pp.\ 746--761. Springer, 2020

    2020

  43. [51]

    Facenet: A unified embedding for face recognition and clustering

    Schroff, F., Kalenichenko, D., and Philbin, J. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 815--823, 2015

    2015

  44. [52]

    The role of artificial intelligence in healthcare: a structured literature review

    Secinaro, S., Calandra, D., Secinaro, A., Muthurangu, V., and Biancone, P. The role of artificial intelligence in healthcare: a structured literature review. BMC medical informatics and decision making, 21: 0 1--23, 2021

    2021

  45. [53]

    Anonymization of sensitive quasi-identifiers for l-diversity and t-closeness

    Sei, Y., Okumura, H., Takenouchi, T., and Ohsuga, A. Anonymization of sensitive quasi-identifiers for l-diversity and t-closeness. IEEE transactions on dependable and secure computing, 16 0 (4): 0 580--593, 2017

    2017

  46. [54]

    A new method of privacy protection: random k-anonymous

    Song, F., Ma, T., Tian, Y., and Al-Rodhaan, M. A new method of privacy protection: random k-anonymous. Ieee Access, 7: 0 75434--75445, 2019

    2019

  47. [55]

    Human action image generation with differential privacy

    Sun, M., Wang, Q., and Liu, Z. Human action image generation with differential privacy. In 2020 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2020

    2020

  48. [56]

    C., and Bialek, W

    Tishby, N., Pereira, F. C., and Bialek, W. The information bottleneck method. arXiv preprint physics/0004057, 2000

    2000 arXiv

  49. [57]

    Wang, S.-Y., Wang, O., Zhang, R., Owens, A., and Efros, A. A. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 8695--8704, 2020

    2020

  50. [58]

    Using randomized response for differential privacy preserving data collection

    Wang, Y., Wu, X., and Hu, D. Using randomized response for differential privacy preserving data collection. In EDBT/ICDT Workshops, volume 1558, pp.\ 0090--6778, 2016

    2016

  51. [59]

    Warner, S. L. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American statistical association, 60 0 (309): 0 63--69, 1965

    1965

  52. [60]

    Privacy-preserving deep action recognition: An adversarial learning framework and a new dataset

    Wu, Z., Wang, H., Wang, Z., Jin, H., and Wang, Z. Privacy-preserving deep action recognition: An adversarial learning framework and a new dataset. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44 0 (4): 0 2126--2139, 2020

    2020

  53. [61]

    Dp-image: Differential privacy for image data in feature space

    Xue, H., Liu, B., Ding, M., Zhu, T., Ye, D., Song, L., and Zhou, W. Dp-image: Differential privacy for image data in feature space. arXiv preprint arXiv:2103.07073, 2021

    2021 arXiv

  54. [62]

    Local differential privacy and its applications: A comprehensive survey

    Yang, M., Guo, T., Zhu, T., Tjuawinata, I., Zhao, J., and Lam, K.-Y. Local differential privacy and its applications: A comprehensive survey. Computer Standards & Interfaces, pp.\ 103827, 2023

    2023

  55. [63]

    S., and Fritz, M

    Yu, N., Davis, L. S., and Fritz, M. Attributing fake images to gans: Learning and analyzing gan fingerprints. In Proceedings of the IEEE/CVF international conference on computer vision, pp.\ 7556--7566, 2019

    2019

  56. [64]

    Differentially private releasing via deep generative model (technical report)

    Zhang, X., Ji, S., and Wang, T. Differentially private releasing via deep generative model (technical report). arXiv preprint arXiv:1801.01594, 2018

    2018 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.