Source-linked AI summary
Censoring Representations with an Adversary
Harrison Edwards, Amos Storkey
TL;DR
The paper addresses how to satisfy fairness and privacy constraints when representations or decisions must limit sensitive information. It learns flexible representations against an adversarial critic in a minimax framework, achieving improved fairness results and encouraging text removal from images without aligned examples. The authors note that adversarial training remains unstable and that image-removal validation can lack ground truth.
Problem
Machine-learning applications need representations or decisions that limit sensitive information, including discrimination in decisions and identifying information in data.
Method
The method learns flexible representations by minimizing an adversary's ability to predict a sensitive variable, using a minimax objective optimized with alternating stochastic gradient updates.
Results
ALFR improves on a related approach across most accuracy-discrimination tradeoffs, while the same setup produces encouraging text removal from images without aligned training pairs.
Takeaways & Limitations
The adversarial setup supports both fair representations for prediction tasks and image transformations that obscure sensitive annotations.
Takeaways & Limitations
Adversarial models are difficult to train because of unstable actor-adversary dynamics, and text-removal approaches may lack ground-truth validation examples.
Abstract
from arXiv · showhide
In practice, there are often explicit constraints on what representations or decisions are acceptable in an application of machine learning. For example it may be a legal requirement that a decision must not favour a particular group. Alternatively it can be that that representation of data must not have identifying information. We address these two related issues by learning flexible representations that minimize the capability of an adversarial critic. This adversary is trying to predict the relevant sensitive variable from the representation, and so minimizing the performance of the adversary ensures there is little or no information in the representation about the sensitive variable. We demonstrate this adversarial approach on two problems: making decisions free from discrimination and removing private information from images. We formulate the adversarial model as a minimax problem, and optimize that minimax objective using a stochastic gradient alternate min-max optimizer. We demonstrate the ability to provide discriminant free representations for standard test problems, and compare with previous state of the art methods for fairness, showing statistically significant improvement across most cases. The flexibility of this method is shown via a novel problem: removing annotations from images, from unaligned training examples of annotated and unannotated images, and with no a priori knowledge of the form of annotation provided to the model.
1 INTRODUCTION
The paper addresses fairness and image privacy by learning representations that reduce sensitive information while preserving useful content or predictions. Its adversarial framework applies to fair decisions and image text removal, including settings without aligned input/output examples.
- Fairness requires decisions to be marginally independent of sensitive variables such as gender, age, or race.
- ALFR learns representations that are both fair and discriminative, allowing the resulting features to be used with any classifier.The approach casts these competing objectives as a minimax problem.
- A deep network produces the representation, while an adversary predicts the sensitive variable from that representation.
- For image anonymization, the method removes private information while distorting images as little as possible, including surnames from face images.The paper also identifies licence plates, medical annotations, logos, and watermarks as example applications.
- The image model requires only separately labeled annotated and unannotated examples rather than aligned input/output pairs.The paper describes aligned pairs as substantially more difficult to obtain than unaligned data.
- Without aligned examples, the model produces plausible images and obscures annotations, although artifacts appear when outputs are enlarged.
2 RELATED WORK
The paper builds on adversarial learning, domain adaptation, and learned fair representations, while extending fairness from classifier-specific constraints to reusable representations and introducing image privacy removal as a new application.
- 2.1 ADVERSARIAL LEARNING: Adversarial learning minimizes dependence between a representation R and a sensitive variable S by training an adversary to predict S from R.
- 2.1 ADVERSARIAL LEARNING: Earlier work used adversarial learning for predictability minimization on synthetic data and later for filters from natural image patches.
- 2.1 ADVERSARIAL LEARNING: Generative adversarial work uses an adversary to distinguish data samples from generated samples.
- 2.1 ADVERSARIAL LEARNING: ALFR is inspired by domain adaptation methods that learn representations in which source and target domains are indistinguishable.
- 2.2 FAIR CLASSIFIERS: Prior fairness methods modify specific classifiers, resample or relabel training data, or learn fair cluster-based representations.
- 2.2 FAIR CLASSIFIERS: Unlike most prior work, ALFR and LFR target fair representations that can potentially be reused across tasks and separated from predictive modeling.The paper states that ALFR is more flexible than LFR in the kinds of representations it can learn.
- 2.2 FAIR CLASSIFIERS: Variational Fair Autoencoder uses latent-variable factorization and an MMD penalty, approaches described as differing from or complementary to the adversarial framework.
- 2.3 IMAGE PRIVACY: The paper presents learned private-information removal from images as an area not previously tackled in the machine learning community, to the authors' knowledge.
3 FORMALISM: FAIRNESS AND DISCRIMINATION
The formalism defines fair binary classification as accurate prediction under statistical parity and measures the tradeoff between classification accuracy and discrimination.
- The setup uses binary inputs X, labels Y, and protected variables S, with examples drawn independently from a joint distribution P.
- The learning goal is a classifier with high accuracy whose predictions satisfy statistical parity or fairness.
- Discrimination is introduced as a key statistic for measuring statistical parity.
- Empirical accuracy is measured as yacc, while N0 and N1 count data items with protected-variable values 0 and 1.
- The objective follows prior work by optimizing the difference between discrimination and classification accuracy.
- The tradeoff parameter t, called the delta, is nonnegative; the paper evaluates models across multiple t values rather than only t = 1.
4 CENSORED REPRESENTATIONS
Censored representations preserve information useful for reconstruction or prediction while reducing dependence on a binary sensitive variable. The approach combines these objectives in a minimax model trained by alternating updates, with image anonymization as a prediction-free application.
- The representation R = Enc(X) should preserve information about X, support prediction of Y, and be approximately independent of S.
- Quantifying dependence: The adversary distinguishes conditional representation distributions for S = 0 and S = 1, while the encoder minimizes this dependence measure.
- Constraints: A constant representation is a trivial solution, so reconstruction or prediction constraints are needed to learn useful representations.
- Joint objective: Reconstruction error, sensitive-variable dependence, and prediction error are combined in a weighted joint loss with hyperparameters α, β, and γ.
- Optimization: Strictly alternating stochastic gradient updates provide a heuristic minimax optimizer without formal convergence guarantees.
- Image anonymization: For image anonymization, the model removes text from images without paired training examples, using reconstructed images as the censored output.
5 EXPERIMENTAL RESULTS
The experiments used the Adam optimizer and were implemented with Theano and Lasagne.
- The experiments used the Adam algorithm with default parameters for all optimizations.
- The implementations used the Theano framework.
- The implementations used the Lasagne Python library.
5.1 FAIRNESS
ALFR was evaluated against LFR on Adult and Diabetes datasets across accuracy–discrimination tradeoffs. ALFR performed significantly better across most of the tested tradeoff range, while greater dependence-term weighting generally reduced discrimination.
- Datasets: ALFR and LFR were evaluated on Adult census-income prediction and Diabetes hospital-readmission prediction datasets.Gender was the sensitive attribute for Adult, and Race for Diabetes.
- Evaluation procedure: The comparison used 100 hyperparameter experiments per model, validation-based selection, five data splits, and tradeoff values t ∈[0, 3].
- Results: ALFR achieved significantly better results than LFR across most accuracy–discrimination tradeoffs on both datasets.
- Hyperparameters: A larger β relative to γ generally lowered discrimination up to a point.The ratio β/(β+γ) measures the relative weighting of dependence reduction versus prediction error.
5.2 IMAGE ANONYMIZATION
The image-anonymization model removes overlaid text while reconstructing plausible faces, using adversarial training and unaligned image examples. Its patch-based design is flexible but leaves artifacts and may benefit from broader-context convolutional modeling.
- Model: The model uses an expert patch-based autoencoder with a patch classifier, copying text-free patches and reconstructing patches predicted to contain text.The full-image adversary classifies whether the reconstructed image contains a text label.
- Evaluation: Validation selects hyperparameters using paired images with and without text and mean-square reconstruction error.The test set also contains corresponding image pairs for evaluation.
- Results: The model learns plausible text-free reconstructions despite never receiving aligned input/output pairs during training.Artifacts become apparent when the results are examined closely.
- Related fairness results: Figure 2 reports validation-selected models across t, with ALFR outperforming LFR on y_t,delta for every Diabetes setting and significantly for approximately t ≤ 2.The figure also displays accuracy, discrimination, paired differences, and 95% confidence intervals.
- Interpretation: The image approach is more flexible than LFR-style clustering because it does not require reconstructing images as convex combinations of template images.This flexibility supports image text removal, whereas the clustering formulation would be difficult to apply here.
6 CONCLUSIONS AND FUTURE WORK
The paper concludes that adversarial censoring can remove sensitive information from representations and improve upon a related fairness approach. It also identifies training stability and harder image-censoring settings as open problems.
- Conclusions: ALFR improves upon a related approach while remaining flexible enough to remove text from images with encouraging results.The same adversarial setup is adapted across representation censoring and image anonymization.
- Limitations: Adversarial training remains difficult because of the unstable dynamics between the actor and adversary.The authors identify theory or heuristics for improving training stability as future work.
- Future work: Removing more pervasive information such as gender from a face is proposed as a more challenging future image-censoring problem.This extends beyond the demonstrated task of removing overlaid text.
- Future work: With only negative examples of images containing text, the method would not apply without further assumptions about the text.Known text information could instead support blurring rather than complete removal.
- Hyperparameters: Figure 3 relates β/(β+γ) to ALFR test discrimination, showing an approximately linear decrease before further increases in β have little effect.The ratio measures the dependence term's relative importance against the prediction-error term.
- Image results: Figure 4 compares input faces on the left with censored autoencoder outputs on the right.The comparison presents the image-anonymization test results.
A THE H-DIVERGENCE
The appendix defines H-divergence as a classifier-based measure of distributional difference and connects adversarial discrimination to this quantity. It also gives empirical and probabilistic foundations for estimating the divergence.
- Definition: An H-divergence measures the difference between two distributions using a hypothesis class of classifiers.The appendix develops this notion for distributions on a common space.
- Definitions: A hypothesis is a mapping η from an input space to binary outputs, while a hypothesis class H is a collection of such hypotheses.These definitions provide the classifier family used in the divergence.
- Definitions: A symmetrical hypothesis class contains each hypothesis together with its inverse binary labeling.For η, the inverse maps η(x) to 1 − η(x).
- Empirical estimation: The empirical H-divergence estimates distributional difference from independent samples drawn from the two distributions.For symmetric H, prior work provides an empirical approximation and probabilistic bound.
- Connection to adversarial censoring: Minimizing an adversary's ability to distinguish two distributions is related to minimizing their H-divergence.The empirical divergence can be related directly to a classifier's discrimination.
- Connection to fairness: For representations conditioned on a binary sensitive variable, the appendix relates classifier discrimination to empirical H-divergence under a symmetric hypothesis class containing the classifier.The derivation uses equal-sized empirical representation samples and symmetry of H.