Pith. sign in

REVIEW 3 major objections 6 minor 70 references

Learning Robust and Privacy-Preserving Representations via Information Theory

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single information-theoretic objective can learn representations that are simultaneously useful, adversarially robust, and private, at the cost of provable trade-offs between privacy and accuracy.

desk verdict The paper's central trade-off theorems are false as stated; the empirical work is solid but the theory needs a major fix before this is publishable. read the letter →

arxiv 2412.11066 v1 pith:WVVOOXBW submitted 2024-12-15 cs.LG cs.CR

Binghui Zhang , Sayedeh Leila Noorbakhsh , Yun Dong , Yuan Hong , Binghui Wang This is my paper · ORCID
classification cs.LGcs.CR
keywords mutualinformationrepresentationlearningadversarialrobustnessattributeinferenceprivacytask-agnosticrepresentationsprivacy-utilitytradeoffvariationalMIboundsvulnerability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes ARPRL, an information-theoretic framework that learns a single task-agnostic representation intended to be simultaneously useful for downstream tasks, robust to adversarial perturbations, and protective of private attributes. The three goals are written as mutual information objectives: minimize $I(z;u)$ to hide the private attribute $u$ from the representation $z$, maximize $I(x;z|u)$ to keep task-relevant information, and minimize the conditional representation vulnerability $RV_\epsilon(f|u)$. The authors prove that adversarial robustness and utility each inherently trade off against attribute privacy, and that worst-case attribute-inference accuracy is bounded by the conditional entropy $H(u|z)$. On CelebA, Loans, and Adult datasets, increasing the privacy weight drives inference accuracy toward random guessing while lowering test and robust accuracy, matching the proved trade-offs. If the framework works as claimed, one shared encoder could serve many unknown downstream tasks with both security and privacy guarantees, without per-task retraining.

What carries the argument

The machinery is a set of three mutual information objectives plus their variational surrogates. Goal 1 minimizes $I(z;u)$ via the vCLUB upper bound, implemented in practice as the cross-entropy of a privacy-inference network (with the second, negative term of vCLUB dropped); Goal 2 maximizes $I(x;z|u)$ through an f-GAN/Jensen-Shannon lower bound; Goal 3 minimizes conditional representation vulnerability $RV_\epsilon(f|u)$, operationalized by finding a PGD worst-case perturbation and maximizing its MINE-estimated mutual information. The theory then leans on a prior result linking adversarial risk to representation vulnerability, and on Lipschitz/Wasserstein/total-variation lemmas that connect the attribute-inference advantage to the risk lower bound.

What would settle it

Train ARPRL with $\alpha$ large enough to drive the privacy-network cross-entropy on the training set to near zero, then evaluate a held-out attribute classifier on the learned representations; if its inference accuracy remains substantially above random guessing, or if a neural MI estimator measures $I(z;u)$ that does not decrease, the surrogate objective is not minimizing the quantity the theorems bound.

Watch

Extended reading notes

Core claim

ARPRL's central claim is that adversarial robustness, attribute privacy, and downstream utility can be pursued simultaneously within one task-agnostic representation learner, and that the tensions among them are information-theoretic necessities rather than empirical accidents. Concretely, Theorem 3 proves $\text{Risk}(C \circ f) \geq \Delta_{y|u} - 2R \cdot C_L \cdot \text{Adv}_D(A)$, and Theorem 4 proves its adversarial analogue, showing that any classifier on a norm-bounded representation must trade standard or adversarial risk against the worst-case attribute-inference advantage: lower privacy leakage forces a higher risk floor. Theorem 5 gives the guaranteed attribute privacy leakage: for any binary attribute inference adversary, $\Pr(A(z)=u) \leq 1 - \frac{H(u|z)}{2\log_2(6/H(u|z))}$, so maximizing conditional entropy $H(u|z)$ — equivalently minimizing $I(z;u)$ — caps the inference accuracy of any adversary. The framework is task-agnostic: a loss combining a cross-entropy privacy adversary, a MINE-based robustness term, and a Jensen-Shannon utility term produces an encoder that can be reused for unknown downstream tasks.

Load-bearing premise

The privacy and robustness guarantees are proved for exact mutual information, but the training objective optimizes variational surrogates that are known to be loose; if the surrogate privacy loss does not actually minimize a valid upper bound on $I(z;u)$, the trained representations need not satisfy the claimed privacy bound.

Editorial extensions

If this is right

  • Any task classifier built on a norm-bounded representation leaks attribute privacy: the smaller the worst-case attribute-inference advantage, the higher the lower bound on standard or adversarial risk (Theorems 3 and 4).
  • Models trained only for adversarial robustness can leak private attributes almost completely; the paper's $\alpha=0$ experiments show inference accuracy of 0.81–0.92, so privacy protection must be made an explicit objective.
  • The worst-case attribute-inference accuracy is capped by $H(u|z)$, and maximizing $H(u|z)$ is exactly the paper's Goal 1, so the training objective and the privacy guarantee are aligned.
  • Because the representation is task-agnostic, the same trained encoder can be shared across unknown downstream tasks while still carrying the robustness/privacy trade-offs, avoiding per-task retraining.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: measuring $I(z;u)$ on a held-out set with a non-parametric estimator would directly reveal whether the cross-entropy surrogate actually tracks the mutual information the theorems bound.
  • Beyond the paper: because Theorems 3–4 place a risk floor proportional to $\Delta_{y|u}$, any downstream task whose labels are strongly correlated with the private attribute will pay an unavoidable accuracy penalty when privacy is enforced — a feature of the data, not a tuning problem.
  • One unstated implication is that robustness and privacy defenses should be designed jointly in representation space: optimizing robustness alone yields near-complete attribute leakage in the paper's experiments, while optimizing privacy alone raises the risk floor.
  • Extending the binary-attribute advantage to continuous sensitive variables through total-variation distance is a direct formal step; the Wasserstein and total-variation lemmas used in the proofs already support such a generalization.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes ARPRL, a task-agnostic representation learning framework that aims to simultaneously provide adversarial robustness and attribute privacy while preserving utility. The method formulates three mutual information objectives (privacy, utility, robustness), replaces exact MI with variational bounds, and trains four neural networks. The authors derive several theoretical results: a robustness-vs-vulnerability bound (Theorem 2), tradeoffs between utility/privacy (Theorem 3) and robustness/privacy (Theorem 4), and an upper bound on attribute inference accuracy (Theorem 5). Experiments on a toy dataset, CelebA, Loans, and Adult Income demonstrate tradeoffs among the three objectives and compare favorably with baselines.

Significance. If the theoretical results were correct, the paper would provide a principled task-agnostic defense with provable trade-offs and a worst-case privacy leakage bound, which would be a meaningful contribution to the adversarial robustness and privacy literature. The empirical results show that the proposed method can reduce attribute inference accuracy at some cost to utility/robustness, and the authors provide code. However, the central theoretical claims contain serious proof errors: Theorem 3 is false as stated, and Theorem 4 inherits the same flaw; additionally, the privacy objective implemented is not shown to minimize a valid upper bound on I(z;u). These issues undermine the advertised guarantees.

major comments (3)
  1. [Proof of Theorem 3 (Eqs. (21)-(22))] The assertion that W1(D_{y|u=0}, cf(D_{u=0})) + W1(D_{y|u=1}, cf(D_{u=1})) ≤ Risk(c∘f) is false. By Eq. (21), each summand is bounded by the conditional risk Risk_{u=a}(c∘f), and Risk(c∘f) = P(u=0)Risk_{u=0} + P(u=1)Risk_{u=1}. The sum of conditional risks is not bounded by the marginal risk unless both attribute classes have probability 1. Concretely, let u be a fair Bernoulli, n be Bernoulli(0.9) independent of u, y = u XOR n, and z = n. Then Δ_{y|u} = 0.8, Adv_D(A) = 0 because z is independent of u, R = 1, C(z) = z is 1-Lipschitz, and Risk(C∘f) = 0.5, violating the theorem. Since Theorem 4 uses the same summation step (Eq. (28) equates the sum of conditional error probabilities with the marginal adversarial risk), it suffers from the same flaw. These trade-off theorems are the paper's main advertised theoretical contributions, so this is a load-bearing error.
  2. [Section 3, Eq. (14) and Appendix B] The reduction from minimizing the vCLUB bound to maximizing E_{p(z,u)}[log qΨ(u|z)] drops the second term of the bound, -E_{p(z)p(u)}[log qΨ(u|z)]. That term is not constant: it depends on f through the marginal p(z), and it also depends on Ψ. The derivation in Appendix B only shows that, for a fixed f, minimizing the KL divergence between p(z,u) and qΨ(z,u) is equivalent to maximizing the first term; it does not justify dropping the second term when optimizing over f. Consequently, the privacy loss implemented in Eq. (9) and Algorithm 1 (the cross-entropy term) is not shown to minimize a valid upper bound on I(z;u). Since Theorem 5's guarantee is expressed in terms of H(u|z), and the paper claims that minimizing I(z;u) maximizes H(u|z), the link between the training objective and the privacy guarantee is missing. The paper's own caveat about the looseness of MI bounds (citing McAllester and Stratos) does not repair this gap.
  3. [Proof of Theorem 5 (Eqs. (29)-(33))] The step 'H(s) ≥ H(u|z) implies Pr(s=1) ≥ H2^{-1}(H(u|z))' is not fully justified. The binary entropy H2(p) is not monotone on [0,1], so an entropy bound alone does not determine which side of 1/2 the error probability lies on. A more careful argument is needed to justify the lower bound on the error probability. This is a technical gap in a secondary guarantee; it may be repairable, but as written the proof is incomplete.
minor comments (6)
  1. [Introduction] The word 'contrivially' should be 'trivially' in the sentence introducing the generalization of prior robust representation learning.
  2. [Section 'Design of ARPRL'] The section title contains the typo 'adversarilly'; this should be corrected.
  3. [Eq. (9)] The constraint α+β ≤ 1 is not stated, yet the coefficient (1-α-β) appears; if α+β > 1, the utility term would change sign, so the feasible range of the hyperparameters should be made explicit.
  4. [Figure 3 caption] The caption refers to 'AdvPPRL' instead of 'ARPRL'; this should be corrected.
  5. [Appendix, Lemma 3] The lemma statement says 'D1 and D1' where it should say 'D1 and D2'.
  6. [Table 2] The table caption states that the utility preservation network is the same as the robust network, but the listed layer sizes differ (e.g., linear-32 vs linear-64); clarify whether these are separate architectures or typographical inconsistencies.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the trade-off and privacy-leakage theorems are proved from external lemmas and are not fitted to or defined by the paper's own objective.

full rationale

The paper's central theoretical claims are derived from external prior results, not from the authors' own fitted quantities. Theorem 2 is obtained by substituting conditional mutual information into Theorem 1 of Zhu, Zhang, and Evans (2020), an external result. Theorems 3 and 4 are proved from standard Wasserstein/TV-distance lemmas, Lipschitz contraction, and Lemma 4 attributed to Liao et al. (2021); the quantities involved (Delta_{y|u}, R, C_L, Adv) are dataset/function-class constants or adversary-optimal definitions, not parameters fitted to the experiments. Theorem 5 is a universal entropy bound using the data processing inequality and Calabro's inverse binary entropy lemma; it does not depend on the ARPRL objective being optimized exactly. The variational MI estimators are explicitly adopted from external work (Cheng et al. 2020; Hjelm et al. 2019; Zhu et al. 2020), and the paper itself flags their looseness via McAllester and Stratos (2020), so the surrogate gap is an acknowledged soundness limitation rather than a circular input-output reduction. The self-citations, including Inf2Guard and the task-agnostic federated learning work, appear only in related-work discussion and are not load-bearing in any proof or uniqueness argument. The skeptical point about Equations (21)-(22) in Theorem 3 is a genuine mathematical correctness concern (the sum of per-attribute conditional risks is not bounded by the marginal risk without class-probability weights), but it is an invalid inequality, not an equivalence-by-construction; accordingly it belongs in correctness risk, not circularity. Overall, no claimed prediction reduces to its own input by definition or by fitted-parameter renaming.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The theoretical results rest on standard information-theoretic and metric-space lemmas, plus domain assumptions about binary attributes, bounded representations, and Lipschitz classifiers. The training objective introduces an unproven reduction of the vCLUB bound and a loosely defined perturbed distribution D'.

free parameters (3)
  • alpha (privacy weight) = tuned per dataset, values include 0, 0.001, 0.005, 0.01, 0.05, 0.1, 0.15, 0.2, 0.5, 0.9
    Hand-tuned trade-off weight in Eq (9); larger alpha gives stronger privacy protection and lower utility and robustness in Table 1.
  • beta (robustness weight) = tuned per dataset, values include 0.05, 0.25, 0.4, 0.45, 0.475, 0.49, 0.495, 0.5
    Hand-tuned trade-off weight in Eq (9); reported results depend on the chosen alpha and beta pairs.
  • lambda (task-label weight) = not reported
    Appears in Eq (9) as a supervised utility term but is absent from Algorithm 1 and the experimental setup; its value is unstated.
assumptions (4)
  • domain assumption Private attribute u is binary
    The attribute advantage definition in Eq (4) and Theorems 2 through 5 assume U={0,1}; the Adult Marital Status experiment uses 7 values, so the guarantees are not directly applicable there.
  • domain assumption Bounded representation norm and Lipschitz task classifier
    Theorems 3 and 4 require max ||z|| <= R and ||C||_L <= C_L; the paper does not verify these for the trained networks, so the numerical bounds may not apply.
  • ad hoc to paper Minimizing the vCLUB bound reduces to maximizing the cross-entropy term
    Appendix B drops the second term E_{p(z)p(u)}[log qPsi(u|z)] of vCLUB without justification; the implemented privacy loss in Eq (9) and Algorithm 1 is only the cross-entropy term.
  • domain assumption The perturbed distribution D' preserves the conditional label distribution and equals the adversarial risk
    Theorem 4 assumes labels are unchanged under perturbation and in Eq (28) equates the average error under D' with the existential adversarial risk, an equality that does not hold in general.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning Robust and Privacy-Preserving Representations via Information Theory." pith.science (2026). https://pith.science/paper/WVVOOXBW

@misc{pith2026241211066,
  author       = {Pith},
  title        = {Pith review of: Learning Robust and Privacy-Preserving Representations via Information Theory},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WVVOOXBW}},
  note         = {Machine review of arXiv:2412.11066}
}
read the original abstract

Machine learning models are vulnerable to both security attacks (e.g., adversarial examples) and privacy attacks (e.g., private attribute inference). We take the first step to mitigate both the security and privacy attacks, and maintain task utility as well. Particularly, we propose an information-theoretic framework to achieve the goals through the lens of representation learning, i.e., learning representations that are robust to both adversarial examples and attribute inference adversaries. We also derive novel theoretical results under our framework, e.g., the inherent trade-off between adversarial robustness/utility and attribute privacy, and guaranteed attribute privacy leakage against attribute inference adversaries.

Figures

Figures reproduced from arXiv: 2412.11066 by the authors.

Figure 1
Figure 1. Overview of ARPRL. Maximizing the worst-case MI in Equation (8) for ad￾versarial robustness. To solve Equation (8), one needs to first find the perturbed data x ′ ∈ Bp(x, ϵ) that minimizes MI I(x ′ ; z ′ |u), and then maximizes this MI by training the representation learner f. As claimed in (Zhu, Zhang, and Evans 2020; Zhou et al. 2022), minimizing the MI on the worst-case perturbed data is computational challenging… view at source ↗
Figure 2
Figure 2. 2D representations learnt by ARPRL. (a) Raw data; (b) only robust representations (privacy acc: 99%, robust acc: [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. 2D t-SNE representations learnt by AdvPPRL. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 59 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    B.; Mironov, I.; Talwar, K.; and Zhang, L

    Abadi, M.; Chu, A.; Goodfellow, I.; McMahan, H. B.; Mironov, I.; Talwar, K.; and Zhang, L. 2016. Deep learning with differential privacy. In CCS

    work page 2016

  4. [4]

    A.; Fischer, I.; Dillon, J

    Alemi, A. A.; Fischer, I.; Dillon, J. V.; and Murphy, K. 2017. Deep variational information bottleneck. In ICLR

    work page 2017

  5. [5]

    Aono, Y.; Hayashi, T.; Wang, L.; and Moriai, S. 2017. Privacy-preserving deep learning: Revisited and enhanced. In ATIS

    work page 2017

  6. [6]

    A.; Noorbakhsh, S

    Arevalo, C. A.; Noorbakhsh, S. L.; Dong, Y.; Hong, Y.; and Wang, B. 2024. Task-Agnostic Privacy-Preserving Representation Learning for Federated Learning against Attribute Inference Attacks. In AAAI

    work page 2024

  7. [7]

    S.; Kim, T.; Hosseinalipour, S.; Joe-Wong, C.; Bagchi, S.; and Brinton, C

    Azam, S. S.; Kim, T.; Hosseinalipour, S.; Joe-Wong, C.; Bagchi, S.; and Brinton, C. 2022. Can we generalize and distribute private representation learning? In AISTATS

    work page 2022

  8. [8]

    I.; Baratin, A.; Rajeshwar, S.; Ozair, S.; Bengio, Y.; Courville, A.; and Hjelm, D

    Belghazi, M. I.; Baratin, A.; Rajeshwar, S.; Ozair, S.; Bengio, Y.; Courville, A.; and Hjelm, D. 2018. Mutual information neural estimation. In ICML

    work page 2018

Show all 70 references
  1. [9]

    Bertran, M.; Martinez, N.; Papadaki, A.; Qiu, Q.; Rodrigues, M.; Reeves, G.; and Sapiro, G. 2019. Adversarially learned representations for information obfuscation and inference. In ICML

    2019

  2. [10]

    C.; Dubost, F.; Katramados, I.; Hogeweg, L.; Liefers, B.; van Ginneken, B.; Pluim, J

    Bortsova, G.; Gonz \'a lez-Gonzalo, C.; Wetstein, S. C.; Dubost, F.; Katramados, I.; Hogeweg, L.; Liefers, B.; van Ginneken, B.; Pluim, J. P.; Veta, M.; et al. 2021. Adversarial attack vulnerability of medical image analysis systems: Unexplored factors. Medical Image Analysis

    2021

  3. [11]

    Calabro, C. 2009. The exponential complexity of satisfiability problems. University of California, San Diego

    2009

  4. [12]

    Carlini, N.; and Wagner, D. 2017. Towards Evaluating the Robustness of Neural Networks. In IEEE S & P

    2017

  5. [13]

    Cheng, P.; Hao, W.; Dai, S.; Liu, J.; Gan, Z.; and Carin, L. 2020. CLUB: A Contrastive Log-ratio Upper Bound of Mutual Information. In ICML

    2020

  6. [14]

    M.; Rosenfeld, E.; and Kolter, J

    Cohen, J. M.; Rosenfeld, E.; and Kolter, J. Z. 2019. Certified adversarial robustness via randomized smoothing. In ICML

    2019

  7. [15]

    Croce, F.; and Hein, M. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML

    2020

  8. [16]

    Dong, Y.; Deng, Z.; Pang, T.; Zhu, J.; and Su, H. 2020. Adversarial distributional training for robust deep learning. In NeurIPS

    2020

  9. [17]

    Dua, D.; and Graff, C. 2017. UCI Machine Learning Repository

    2017

  10. [18]

    Eykholt, K.; Evtimov, I.; Fernandes, E.; Li, B.; Rahmati, A.; Xiao, C.; Prakash, A.; Kohno, T.; and Song, D. 2018. Robust physical-world attacks on deep learning visual classification. In CVPR

    2018

  11. [19]

    Feng, S.; Mohammady, M.; Hong, H.; Yan, S.; Kundu, A.; Wang, B.; and Hong, Y. 2024. Universally Harmonizing Differential Privacy Mechanisms for Federated Learning: Boosting Accuracy and Convergence. arXiv

    2024

  12. [20]

    L.; and Su, F

    Gibbs, A. L.; and Su, F. E. 2002. On choosing and bounding probability metrics. International statistical review, 70(3): 419--435

    2002

  13. [21]

    Goodfellow, I.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014. Generative adversarial nets. In NIPS

    2014

  14. [22]

    Hamm, J. 2017. Minimax filter: Learning to preserve privacy from inference attacks. JMLR

    2017

  15. [23]

    Hardt, M.; Price, E.; and Srebro, N. 2016. Equality of Opportunity in Supervised Learning. In NIPS

    2016

  16. [24]

    D.; Fedorov, A.; Lavoie-Marchildon, S.; Grewal, K.; Bachman, P.; Trischler, A.; and Bengio, Y

    Hjelm, R. D.; Fedorov, A.; Lavoie-Marchildon, S.; Grewal, K.; Bachman, P.; Trischler, A.; and Bengio, Y. 2019. Learning deep representations by mutual information estimation and maximization. In ICLR

    2019

  17. [25]

    Hong, H.; Wang, B.; and Hong, Y. 2022. Unicr: Universally approximated certified robustness via randomized smoothing. In ECCV

    2022

  18. [26]

    Hong, H.; Zhang, X.; Wang, B.; Ba, Z.; and Hong, Y. 2024. Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence. In CCS

    2024

  19. [27]

    Jeong, J.; Cho, M.; Benz, P.; and Kim, T.-h. 2023. Noisy adversarial representation learning for effective and efficient image obfuscation. In UAI

    2023

  20. [28]

    Jia, J.; Wang, B.; Zhang, L.; and Gong, N. Z. 2017. AttriInfer: Inferring User Attributes in Online Social Networks Using Markov Random Fields. In WWW

    2017

  21. [29]

    S.; Hammock, C.; Mambretti, J.; Barnes, A.; Halbach, F.; Rocha, A.; and Stubbs, J

    Keahey, K.; Anderson, J.; Zhen, Z.; Riteau, P.; Ruth, P.; Stanzione, D.; Cevik, M.; Colleran, J.; Gunawi, H. S.; Hammock, C.; Mambretti, J.; Barnes, A.; Halbach, F.; Rocha, A.; and Stubbs, J. 2020. Lessons Learned from the Chameleon Testbed. In USENIX ATC

    2020

  22. [30]

    Kurakin, A.; Goodfellow, I.; and Bengio, S. 2017. Adversarial machine learning at scale. In ICLR

    2017

  23. [31]

    Lecuyer, M.; Atlidakis, V.; Geambasu, R.; Hsu, D.; and Jana, S. 2019. Certified robustness to adversarial examples with differential privacy. In IEEE SP

    2019

  24. [32]

    Li, A.; Guo, J.; Yang, H.; and Chen, Y. 2021. Deepobfuscator: Adversarial training framework for privacy-preserving image classification. arXiv

    2021

  25. [33]

    J.; Jegelka, S.; and Salakhutdinov, R

    Liao, P.; Zhao, H.; Xu, K.; Jaakkola, T.; Gordon, G. J.; Jegelka, S.; and Salakhutdinov, R. 2021. Information obfuscation of graph neural networks. In ICML

    2021

  26. [34]

    Liu, S.; Du, J.; Shrivastava, A.; and Zhong, L. 2019. Privacy Adversarial Network: Representation Learning for Mobile Data Privacy. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 3(4): 1--18

    2019

  27. [35]

    Liu, Z.; Luo, P.; Wang, X.; and Tang, X. 2015. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, 3730--3738

    2015

  28. [36]

    Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards deep learning models resistant to adversarial attacks. In ICLR

    2018

  29. [37]

    Mao, C.; Zhong, Z.; Yang, J.; Vondrick, C.; and Ray, B. 2019. Metric learning for adversarial robustness. Advances in Neural Information Processing Systems, 32

    2019

  30. [38]

    McAllester, D.; and Stratos, K. 2020. Formal Limitations on the Measurement of Mutual Information. arXiv:1811.04251

    2020 arXiv

  31. [39]

    Melis, L.; Song, C.; De Cristofaro, E.; and Shmatikov, V. 2019. Exploiting unintended feature leakage in collaborative learning. In IEEE SP

    2019

  32. [40]

    L.; Zhang, B.; Hong, Y.; and Wang, B

    Noorbakhsh, S. L.; Zhang, B.; Hong, Y.; and Wang, B. 2024. Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attacks. In USENIX Security

    2024

  33. [41]

    Nowozin, S.; Cseke, B.; and Tomioka, R. 2016. f-gan: Training generative neural samplers using variational divergence minimization. In NIPS

    2016

  34. [42]

    J.; Fritz, M.; and Schiele, B

    Oh, S. J.; Fritz, M.; and Schiele, B. 2017. Adversarial image perturbation for privacy protection a game theory perspective. In ICCV

    2017

  35. [43]

    A.; Taheri, A.; Shamsabadi, A

    Osia, S. A.; Taheri, A.; Shamsabadi, A. S.; Katevas, K.; Haddadi, H.; and Rabiee, H. R. 2018. Deep private-feature extraction. IEEE TKDE

    2018

  36. [44]

    Pang, T.; Xu, K.; Du, C.; Chen, N.; and Zhu, J. 2019. Improving adversarial robustness via promoting ensemble diversity. In ICML

    2019

  37. [45]

    B.; Kanazawa, A.; Toyer, S.; Abbeel, P.; and Levine, S

    Peng, X. B.; Kanazawa, A.; Toyer, S.; Abbeel, P.; and Levine, S. 2019. Variational discriminator bottleneck: Improving imitation learning, inverse rl, and gans by constraining information flow. In ICLR

    2019

  38. [46]

    Pittaluga, F.; Koppal, S.; and Chakrabarti, A. 2019. Learning privacy preserving encodings through adversarial training. In WACV

    2019

  39. [47]

    Poole, B.; Ozair, S.; Oord, A. v. d.; Alemi, A. A.; and Tucker, G. 2019. On variational bounds of mutual information. In ICML

    2019

  40. [48]

    Qu, W.; Li, Y.; and Wang, B. 2023. A Certified Radius-Guided Attack Framework to Image Segmentation Models. In IEEE EuroSP

    2023

  41. [49]

    C.; and Boddeti, V

    Roy, P. C.; and Boddeti, V. N. 2019. Mitigating information leakage in image representations: A maximum entropy approach. In CVPR

    2019

  42. [50]

    Salem, A.; Cherubin, G.; Evans, D.; K \"o pf, B.; Paverd, A.; Suri, A.; Tople, S.; and Zanella-B \'e guelin, S. 2023. SoK: Let the privacy games begin! A unified treatment of data inference privacy in machine learning. In IEEE SP

    2023

  43. [51]

    Shokri, R.; and Shmatikov, V. 2015. Privacy-preserving deep learning. In CCS

    2015

  44. [52]

    Song, L.; Shokri, R.; and Mittal, P. 2019 a . Membership inference attacks against adversarially robust deep learning models. In SPW

    2019

  45. [53]

    Song, L.; Shokri, R.; and Mittal, P. 2019 b . Privacy risks of securing machine learning models against adversarial examples. In CCS

    2019

  46. [54]

    Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv

    2013

  47. [55]

    Van der Maaten, L.; and Hinton, G. 2008. Visualizing data using t-SNE. JMLR, 9(11)

    2008

  48. [56]

    Varun, M.; Feng, S.; Wang, H.; Sural, S.; and Hong, Y. 2024. Towards Accurate and Stronger Local Differential Privacy for Federated Learning with Staircase Randomized Response. In CODASPY

    2024

  49. [57]

    Wang, B.; Guo, J.; Li, A.; Chen, Y.; and Li, H. 2021. Privacy-preserving representation learning on graphs: A mutual information perspective. In Proceedings of the 27th acm sigkdd conference on knowledge discovery & data mining, 1667--1676

    2021

  50. [58]

    Wang, Y.; Zou, D.; Yi, J.; Bailey, J.; Ma, X.; and Gu, Q. 2019. Improving adversarial robustness requires revisiting misclassified examples. In ICLR

    2019

  51. [59]

    Wong, E.; and Kolter, Z. 2018. Provable defenses against adversarial examples via the convex outer adversarial polytope. In ICML

    2018

  52. [60]

    Wong, E.; Rice, L.; and Kolter, J. Z. 2020. Fast is better than free: Revisiting adversarial training. In ICLR

    2020

  53. [61]

    Wu, Z.; Wang, Z.; Wang, Z.; and Jin, H. 2018. Towards privacy-preserving visual recognition via adversarial training: A pilot study. In ECCV

    2018

  54. [62]

    Xie, S.; and Hong, Y. 2022. Differentially private instance encoding against privacy attacks. In NAACL-W

    2022

  55. [63]

    Xu, N.; Wang, B.; Ran, R.; Wen, W.; and Venkitasubramaniam, P. 2022. Neuguard: Lightweight neuron-guided defense against membership inference attacks. In ACSAC

    2022

  56. [64]

    Zhai, R.; Dan, C.; He, D.; Zhang, H.; Gong, B.; Ravikumar, P.; Hsieh, C.-J.; and Wang, L. 2020. MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius. In ICLR

    2020

  57. [65]

    Zhang, H.; Yu, Y.; Jiao, J.; Xing, E.; El Ghaoui, L.; and Jordan, M. 2019. Theoretically principled trade-off between robustness and accuracy. In ICML

    2019

  58. [66]

    Zhang, X.; Hong, H.; Hong, Y.; Huang, P.; Wang, B.; Ba, Z.; and Ren, K. 2024. Text-crs: A generalized certified robustness framework against textual adversarial attacks. In IEEE SP

    2024

  59. [67]

    Zhao, H.; Chi, J.; Tian, Y.; and Gordon, G. J. 2020. Trade-offs and guarantees of adversarial representation learning for information obfuscation. In NeurIPS

    2020

  60. [68]

    Zhou, D.; Liu, T.; Han, B.; Wang, N.; Peng, C.; and Gao, X. 2021. Towards defending against adversarial examples via attack-invariant features. In ICML

    2021

  61. [69]

    Zhou, D.; Wang, N.; Gao, X.; Han, B.; Wang, X.; Zhan, Y.; and Liu, T. 2022. Improving Adversarial Robustness via Mutual Information Estimation. In ICML

    2022

  62. [70]

    Zhu, S.; Zhang, X.; and Evans, D. 2020. Learning adversarially robust representations via worst-case mutual information maximization. In ICML

    2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.