# Uncertainty-Autoencoder-Based Privacy and Utility Preserving Data Type
Conscious Transformation

Bishwas Mandal  Department of Computer Science
Kansas State University
Manhattan, KS 66506, USA
<EMAIL_ADDRESS>George Amariucai  Department of Computer Science
Kansas State University
Manhattan, KS 66506, USA
<EMAIL_ADDRESS>Shuangqing Wei  Division of Electrical & Computer
Engineering
Louisiana State University
Baton Rouge, LA 70803, USA
<EMAIL_ADDRESS>
###### Abstract

We propose an adversarial learning framework that deals with the privacy-
utility tradeoff problem under two types of conditions: data-type ignorant,
and data-type aware. Under data-type aware conditions, the privacy mechanism
provides a one-hot encoding of categorical features, representing exactly one
class, while under data-type ignorant conditions the categorical variables are
represented by a collection of scores, one for each class. We use a neural
network architecture consisting of a generator and a discriminator, where the
generator consists of an encoder-decoder pair, and the discriminator consists
of an adversary and a utility provider. Unlike previous research considering
this kind of architecture, which leverages autoencoders (AEs) without
introducing any randomness, or variational autoencoders (VAEs) based on
learning latent representations which are then forced into a Gaussian
assumption, our proposed technique introduces randomness and removes the
Gaussian assumption restriction on the latent variables, only focusing on the
end-to-end stochastic mapping of the input to privatized data. We test our
framework on different datasets: MNIST, FashionMNIST, UCI Adult, and US Census
Demographic Data, providing a wide range of possible private and utility
attributes. We use multiple adversaries simultaneously to test our privacy
mechanism – some trained from the ground truth data and some trained from the
perturbed data generated by our privacy mechanism. Through comparative
analysis, our results demonstrate better privacy and utility guarantees than
the existing works under similar, data-type ignorant conditions, even when the
latter are considered under their original restrictive single-adversary model.

###### Index Terms:

data privacy, utility, min-max, optimization, autoencoder, categorical
features, data-type-aware privacy.

##  I Introduction

With the recent surge in the usage of online services, we share an
increasingly large amount of data with different service providers in order to
receive some form of utility. Even when we pay special attention to avoid
disclosing what we deem to be private information, such as our identity, age,
race, location, gender, income, medical conditions, political views etc., the
data that we do share may still contain an uncomfortably large amount of
information about these attributes – an amount that may be just enough for
intruders to infer our private/sensitive data. Recently, Google dropped its
FLoC (Federated Learning of Cohorts) project after criticism that it could
lead to sensitive data being inferred from user behavior and interests. It is
therefore important to be aware of such potential data correlations, and to
employ a privacy mechanism that can essentially destroy the information
between the shared data and the private data, while preserving the useful
information – that required to achieve the desired level of utility. We call
such a mechanism a _privacy and utility preserving end-to-end transformation
(PUPET)_.

Ideally, a PUPET should minimize the leakage of information about the private
attributes, and maximize the information that the shared data contains about
the utility attributes. The operation of a privacy mechanism is said to
achieve a privacy-utility tradeoff when it establishes certain points in some
private-information-utility-information plane. Most notions of privacy, such
as Differential Privacy [1, 2], or k-anonymity [3] are achieved by using some
sort of distortion, such as adding random noise to the data, or performing
data suppression or generalization. The privacy-utility tradeoff is the
subject of a large body of research, with many works focused on producing
application-specific solutions for the problem [4, 5, 6, 7, 8]. [9] shows the
drawbacks of k-anonymity and its variant. Similarly, it is known that
computing the optimal noise addition in higher dimensional data for
differential privacy can potentially be infeasible. Therefore, a wide majority
of recent techniques use neural networks and adversarial learning, which can
deal with the high dimensional data and can provide an approximation of the
underlying functions. In particular, research works such as [10, 11, 12, 13,
14, 15, 16, 17, 18, 19, 20, 21] have been carried out leveraging autoencoder
(AE) or variational autoencoder (VAE) [22] and/or generative adversarial
network (GAN) type training [23] or some other adversarial optimization
techniques such as GRL [24] and K-Beam [25]. Similarly, [26] use the loss
function of both VAEs and GANs together along with their application specific
classifier. AEs or VAEs are used to create compressed latent representations
capturing minimum and maximum information about the private and utility
features, respectively. AEs perform compression alone, without introducing
randomness, while VAEs introduce randomness when sampling from the mean and
variance of the latent space – they also model explicitly the prior
distribution over the latent variable. VAE loss functions include a
regularization term to minimize the KL divergence between the variational
posterior over the latent variable and some prior distribution (which, for the
convenience of generating data in the absence of an encoder, is usually chosen
to be white Gaussian). GANs, on the other hand, involve a min-max game between
the generator and discriminator. Similarly, recent obfuscation mechanisms [27,
28, 29] demonstrate privacy preservation by first estimating each feature’s
information density relative to the private data, and then selectively
distorting the most information-leaking features.

All these different techniques require either training a filter that adds
noise, or adding noise directly into the input stream while training, or
introducing distortion via lossy compression or some other form of masking
technique. In addition, most of these techniques are tested on image datasets,
for which there is no restriction on the output of data, compared to
categorical features, where the output should be a one-hot encoding that
represents precisely one class. In the adversarial learning framework, most
research involving datasets that include categorical features either uses an
adversary trained directly on the latent variables [10, 16], or one trained on
the generator output but without enforcing any constraints based on the data
type (data-type-ignorant conditions) [12]. This lack of constraints mean that
the output of the privacy mechanism doesn’t represent an exact class, but
rather some scores associated with different classes. The notion of adding
noise or distortion to categorical variables in data publishing can be
impractical as users are likely to publish data at a higher level where they
will be limited to mentioning one particular class. Another notable issue in
existing works is that most of the privacy mechanisms are tested under a
single and particular type of adversary network which cannot demonstrate the
_actual privacy leakage_ as there might be different adversary models capable
of inferring private features with higher accuracy which can diminish the
claims of particular privacy mechanisms. For example, [30] proposed the
_strong adversary_ – an adversary that is trained using the perturbed data
generated by their privacy mechanism and ground truth labels – and show that
the adversary’s accuracy increased from 50% (weak adversary – trained using
ground truth image and labels) to 75% i.e. a 25% (absolute) increase in
inferring private information. In order to make the privacy mechanism robust
against multiple adversaries, [17, 21] propose _privacy budget model
restarting and ensemble_.

Inspired by these studies, in this paper, we propose an adversarial learning
framework that deals with the privacy-utility tradeoff problem under two
conditions: data-type-ignorant, and data-type-aware conditions. Data-type-
ignorant refers to the classic privacy-utility tradeoff setting where the
categorical variables after privatization are not enforced to belong to one
particular class. The data-type-aware condition, on the other hand, refers to
the optimization settings where the output of the _PUPET_ generator enforces
the correct representation of categorical variables by assigning a one to the
_argmax_ index of the probability distribution and assigning zero to all other
indices before passing the data to the adversary and utility provider in the
_testing phase_. Thereafter, we test our privacy mechanism on multiple
adversaries– some trained from ground truth data and true labels (weak
adversaries) and some trained from the perturbed data generated from the
privacy mechanism and true labels (strong adversaries). Furthermore, in our
proposed privacy mechanism, we introduce randomness and remove the Gaussian
assumption on the prior distribution of the latent variable and only focus on
the end-to-end stochastic mapping to transform data that preserves privacy and
utility. The Gaussian assumption used by VAEs is useful for ancestral
sampling, which is not required in the generation of privatized data. Instead,
we require a Markov chain $(X\xrightarrow{}Z\xrightarrow{}\hat{X})$ where $X$
is the input data, $Z$ is the latent variable and $\hat{X}$ is the privatized
data. To implement our privacy mechanism, we leverage Uncertainty Autoencoders
(UAEs) [31], which define an implicit generative model without specifying a
prior on the latent representation. The use of a Markov chain to generate
privatized data is necessary regardless of the generative model (AE, VAE, or
UAE) and thus, the use of UAE doesn’t make the process any more
computationally expensive than previous approaches. In our adversarial
setting, UAE behaves as a generator and learns from its own loss, along with
the loss of the discriminators, to generate privatized data that maintains its
utility to the utility provider. On the other hand, the discriminators
(adversary and utility provider) learn to infer private and utility features,
respectively, from the privatized data generated by the generator.

Figure 1: MNIST: Odd and even adjacent columns show original and privatized
versions respectively. For most images, numbers are still in the same category
(utility attribute: $\geq 5$ or $<5$) while being switched from odd to even
(private attribute). Some digits change from odd to even but also switch from
$\geq 5$ to $<5$, and some remain unchanged.

To showcase the effectiveness of our proposed privacy mechanism, we perform
comprehensive experiments on four datasets viz. MNIST handwritten digits [32],
Fashion MNIST [33], UCI Adult [34], and US Census Demographic Data [35].
Except UCI Adult, the other datasets do not contain categorical features and
thus fit well with data-type-ignorant conditions. Firstly, we evaluate our
proposed method under data-type-ignorant conditions for all the four datasets
considering multiple adversary models and compare results with the existing
mechanisms. In particular, we directly compare our proposed UAE-based PUPET
(or _UAE-PUPET_) mechanism to that of [16], in the same setting as in [16],
using their MNIST Case2 (variant). We show that our mechanism attains 2.6%
less accuracy for the private feature, and 11.2% higher accuracy for the
utility feature, thus clearly outperforming the previously existing mechanism.
It is worth mentioning that this result was obtained by our UAE-PUPET under
the best-performing adversary out of multiple adversaries that includes weak
adversary, strong adversary, and adversary trained together with utility
provider and privacy mechanisms, at the time of adversarially training the
privacy mechanism. This shows that our mechanism is fairly robust, despite the
use of a single-adversary model at the time of training, instead of an
ensemble of adversaries as in [17] and [21], and also provides better privacy
and utility guarantees than [16], which is tested against a single adversary
model. Thereafter, we evaluate our privacy mechanism under data-type-aware
conditions for the UCI Adult dataset and demonstrate similarity in performance
between the claimed leakage (data-type-ignorant condition when dataset has
categorical features) and actual leakage in practical applications.

The rest of the paper is organized as follows. The problem formulation and
methodology is detailed in Section II, experimental results are given in
Section III, and concluding remarks are drawn in Section IV.

##  II Problem Formulation and Methodology

Consider a setting where a user wishes to release some data vector $X$ with
the intent to receive certain level utility, while maintaining a certain level
of privacy about a specific feature or set of features. We represent the
private feature vector as $X_{P}$ and the utility feature vector as $X_{U}$,
and expect that they are both correlated with $X$. To ensure the desired
privacy and utility guarantees, before publicly sharing their data $X$, users
employ a PUPET that takes $X$ as input, and generates $\hat{X}$, a distorted
version of $X$ which contains minimum information about $X_{P}$ and maximum
information about $X_{U}$. The data $\hat{X}$ is then shared publicly.

Figure 2: UAE-PUPET architecture. This architecture supports both conditions
(data-type-ignorant and aware conditions). After the completion of training,
we detach the discriminator, and use the generator to generate privatized data
$\hat{X}$.

It is very important to note here that the disclosed data $\hat{X}$ is usually
required to preserve in general the size and structure of $X$. That is, while
it may be tempting to devise a compression mechanism – for example, through a
simple arbitrary affine transformation – that produces a shorter $\hat{X}$,
each component of which is some affine transformation of the components of
$X$, such a mechanism has very little applicability in practice. This is
because usually the disclosure of $\hat{X}$ has to take place over a pre-
existing platform, outside of the data owner’s control, which is designed
specifically for $X$. This platform usually has very specific fields that the
user needs to fill out, so that the structure of $X$ is enforced on the
PUPET’s output. It is also worth noting that most currently existing platforms
(such as social media platforms) would provide their utility by taking the
values of $\hat{X}$ at face value, as if it was the original $X$ that was
being disclosed, which motivates some of the existing privacy-utility tradeoff
works to use the distance between $\hat{X}$ and $X$ as a measure of utility
[36, 37, 38, 39, 40, 41, 42, 43]. However, unlike these works, we consider a
smart and informed utility provider, who is aware of the privacy mechanism
employed by the user – of course, without knowing the exact realizations of
the randomness it uses, and can make a competent inference about the utility
feature, using a neural-network-based architecture.

This setup raises questions as to who would use such services in real life, as
well as whether such a setup would actually occur. One of the many examples is
the creation of an e-commerce account, when certain information would need to
be entered. The underlying platform gathers the information we share, and may
develop implicit models to recognize, e.g., our gender and income. However,
users might not be comfortable knowing that these implicit models learn about
their income, but at the same time would also want to get better
recommendation of products based on their gender. In such a case, the users
can use a PUPET which generates $\hat{X}$, and then use $\hat{X}$ to fill up
the information to create an account. The training of the PUPET requires
multiple tuples $(X,X_{P},X_{U})$, collected from users who do not mind
disclosing $X_{P},~{}X_{U}$, and can be handled either by the data owner, or
by a trusted service provider. Similarly, social media giants such as
Facebook, Instagram, Twitter etc. sell users’ data to different vendors. Such
platforms can also use the formulated privatization services by ensuring the
vendor only receives the data they paid for, i.e. privatize all the
information about other features which they don’t get paid for. Countless
other applications can be envisioned.

Algorithm 1 UAE-PUPET – pseudocode for training and testing for data-type-
ignorant and data-type-aware conditions

// One step training

Step 1:

$\hat{\textbf{X}}\leftarrow\textbf{f}(X,X_{P},X_{U})$

Step 2:

$X^{\prime}_{P}\leftarrow a_{p}(\hat{\textbf{X}})$,then calculate cross
entropy loss i.e. $l_{P}$

$X^{\prime}_{U}\leftarrow a_{u}(\hat{\textbf{X}})$, then calculate cross
entropy loss i.e. $l_{U}$

Step 3:

Calculate generator loss and update $\gamma$.

// To calculate generator loss or $(gen\\_loss)$:

calculate reconstruction loss i.e. mse$(X,\hat{\textbf{X}})$

$gen\\_loss\leftarrow\textit{reconstruction
loss}+(\lambda_{U}*l_{U})-(\lambda_{P}*l_{P})$

Back propagate and update $\gamma$ parameters.

Step 4: Take Step 1, then $X_{P}^{\prime}\leftarrow a_{p}(\hat{\textbf{X}})$,
then calculate private_loss i.e. $l_{P}$

Back propagate and update $\gamma_{P}$ parameters.

Step 5: Take Step 1, then $X_{U}^{\prime}\leftarrow a_{u}(\hat{\textbf{X}})$,
then calculate utility_loss i.e. $l_{U}$

Back propagate and update $\gamma_{U}$ parameters.

// Testing

Take Step 1 to generate privatized data $\hat{\textbf{X}}$.

if data-type-ignorant condition then

pass // $\hat{\textbf{X}}$ without data type constraints

else if data-type-aware condition then

for each categorical variable ${\hat{\textbf{X}}[i:j}]$ do

$\hat{\textbf{X}}[i:j]\leftarrow
enforce\\_constraints({\hat{\textbf{X}}[i:j]})$

// $enforce\\_constraints$ assigns $1$ to argmax index

// and assigns $0$ to other indices

end for

end if

$X_{P}^{\prime}\leftarrow a_{p}(\hat{\textbf{X}})$, then evaluate private
accuracy.

$X_{U}^{\prime}\leftarrow a_{u}(\hat{\textbf{X}})$, then evaluate utility
accuracy.

// Recall privatized data is tested under multiple adversaries.

Formally, denote $X^{j}=\\{x^{j}_{1},x^{j}_{2},x^{j}_{3},\cdots
x^{j}_{n^{j}}\\}$, where the components $x^{j}_{i}$ are all correlated random
variables denoting $n$ distinct features of the user $U^{j}$, which the user
wishes to release to the public. In addition, the user $U^{j}$ contains
private features $X^{j}_{P}$, and utility features $X^{j}_{U}$, with
$n^{j}_{p}$ and $n^{j}_{u}$ component random variables, respectively. Note
that $X^{j}_{P}$ and $X^{j}_{U}$ are both correlated with $X^{j}$ and no
private and utility feature is in $X^{j}$ i.e. $X^{j}_{P}\notin X^{j}$ and
$X^{j}_{U}\notin X^{j}$. For different users, the choice of the data they wish
to share, as well as the private features and the utility features, differ and
thus our privacy mechanism needs to be trained differently for different sets
of users. For simplicity we drop the user-specific indices and refer to the
random vectors directly as $X$, $X_{P}$ and $X_{U}$. We represent the PUPET in
its most general form as a function $f$ (which could be a randomized mapping)
that takes input $(X,X_{P},X_{U})$ and generates $\hat{X}$ i.e.
$\hat{X}=f(X,X_{P},X_{U})$. The adversary builds a learning algorithm $a_{p}$
that takes privatized data $\hat{X}$ to infer the private attributes
$X_{P}^{\prime}$ which is an estimate of $X_{P}$ i.e.
$X_{P}^{\prime}=a_{p}(\hat{X})$. The goal of adversary is to minimize the loss
between $X_{P}^{\prime}$ and $X_{P}$ i.e.
$l_{P}(X_{P}^{\prime},X_{P})=l_{P}(a_{p}(f(X,X_{P},X_{U})),X_{P})$.
Correspondingly, the utility provider builds a learning algorithm $a_{u}$ to
infer $X_{U}^{\prime}$ which is an estimate of $X_{U}$ and desires to minimize
the loss $l_{U}(X_{U}^{\prime},X_{U})=l_{U}(a_{u}(f(X,X_{P},X_{U})),X_{U})$.
The privacy mechanism $f$ is now chosen to maximize the inference loss $l_{P}$
and minimize the inference loss $l_{U}$. This setting refers to the min-max
game expressed as follows:

$\begin{split}\max_{f\in\mathpzc{F}}\Biggl{\\{}\lambda_{P}\min_{a_{p}\in\mathpzc{A_{P}}}\mathbb{E}\left[l_{P}\left(a_{p}\left(f\left(X,X_{P},X_{U}\right)\right),X_{P}\right)\right]\\\
-\lambda_{U}\min_{a_{u}\in\mathpzc{A_{U}}}\mathbb{E}\left[l_{U}\left(a_{u}\left(f\left(X,X_{P},X_{U}\right)\right),X_{U}\right)\right]\Biggr{\\}},\end{split}$
(1)

where $\lambda_{P},\lambda_{U}$ are hyperparameters that control the tradeoff
between adversary loss and utility provider loss, and the expectation is taken
over all samples of the dataset, and $\mathpzc{F}$, $\mathpzc{A_{P}}$ and
$\mathpzc{A_{U}}$ are the sets of functions from which the privacy mechanism,
the adversary and the utility provider select their corresponding operators,
respectively. In this paper we shall use neural networks to optimize over
different functions $f,a_{p},a_{u}$ and the losses $l_{P}$ and $l_{U}$ are
instantiated as the cross-entropy loss [44].

In order to solve the optimization problem in Eq.(1), we leverage an
uncertainty autoencoder (UAE), which serves as the generator for our privacy
mechanism. The objective of UAE is given by
$\max_{\theta,\phi}\mathbb{E}_{Q_{\phi}(X,Z)}\left[\log
p_{\theta}(x|z)\right]$, where $X$ is the input data distribution, $Z$ is the
latent variable, $\phi,\theta$ are parameters of encoder and decoder,
respectively, $Q_{\phi}(X,Z)$ is the true joint distribution of the input and
latent representation, and $p_{\theta}(X|Z)$ is the likelihood function
produced by the decoder, which aims to emulate $Q_{\phi}(X|Z)$ as closely as
possible. Notice that we don’t force a Gaussian assumption, or any other
distribution assumption, on the latent variable marginal distribution, and
thus we don’t have a KL divergence term in the objective of the UAE, as is the
case for the VAE. Instead we focus only on the end-to-end stochastic mapping.
Additionally, UAE’s encoder outputs only the mean, and sampling is done in the
latent space with a fixed variance. If the variance of the noise sampled in
the latent space equals zero, the learning objective of the UAE is the same as
that of a standard AE. In our adversarial setting, we introduce the parameter
$\gamma$, which represents the weights of the generator (encoder-decoder pair)
with function $f$ (basically, $\gamma=(\phi,\theta)$). Additionally, the
output of the generator is attached to the discriminator, which consists of an
adversary and a utility provider as shown in Fig. 2. The adversary learns the
function $a_{p}$ with parameters $\gamma_{P}$ to minimize the privacy-specific
loss $l_{P}(X_{P}^{\prime},X_{P})$. Similarly, the utility provider learns the
$a_{u}$ with parameters $\gamma_{U}$ to minimize the utility-specific loss
$l_{U}(X_{U}^{\prime},X_{U})$. Conversely, the generator function $f$ with
parameter $\gamma$ learns to maximize $l_{P}(X_{P}^{\prime},X_{P})$ and
minimize $l_{U}(X_{U}^{\prime},X_{U})$ respectively along with the objective
of UAE. In this setting, the neural network parameters
$\gamma,\gamma_{P},\gamma_{U}$ all are trained together to solve the following
optimization problem shown in Eq.(2).

$\begin{split}\max_{\gamma}\Biggl{\\{}\mathbb{E}_{Q_{\phi}(X,Z)}\left[\log
p_{\theta}(x|z)\right]+\lambda_{P}\min_{\gamma_{P}}\left\\{\mathbb{E}\left[l_{P}\left(X_{P}^{\prime},X_{P}\right)\right]\right\\}-\\\
\lambda_{U}\min_{\gamma_{U}}\left\\{\mathbb{E}\left[l_{U}\left(X_{U}^{\prime},X_{U}\right)\right]\right\\}\Biggr{\\}}\text{,
where}\\\ X_{P}^{\prime}=a_{p}(f(X,X_{P},X_{U}))\text{ ,
}X_{U}^{\prime}=a_{u}(f(X,X_{P},X_{U})).\end{split}$ (2)

##  III Experiments and Results

We perform comprehensive experiments on four widely-used datasets such as
MNIST, Fashion MNIST, UCI-adult, and US Census Demographic Data, to
demonstrate the effectiveness of our privacy mechanism i.e. solving the
optimization problem in Eq.(2). Firstly, we discuss the results for data-type-
ignorant conditions and compare them to existing works wherever possible and
then present the result of data-type-aware conditions. We perform experiments
with hyperparameter $\lambda_{P}$ = [0,10,20,…,100] for data-type-ignorant
conditions and plot a UPT (Utility Privacy Tradeoff) curve. The UPT curve is
used to represent the upper bound on the performance of the privacy-utility
mechanism. As such, it consists of the upper convex hull of all the achieved
operational points. The operational interpretation of the upper convex hull
relies on an operational interpretation of any line connecting two operational
points. Recall that each operational point is defined by two accuracy levels,
achieved by averaging over an entire test dataset. If we split the test
dataset in two parts of sizes $\alpha$ and $1-\alpha$ times the original size,
respectively, and apply the first part to the mechanism achieving operational
point $P_{1}$, and the second part to the mechanism achieving $P_{2}$, then
the average over the entire dataset should achieve operational point $\alpha
P_{1}+(1-\alpha)P_{2}$. It is in this sense that the upper convex hull is
achievable. Notice that for each $\lambda_{P}$ value, we conduct 25
experiments with random weight initialization and then report the mean for
that particular $\lambda_{P}$. Similarly, the _best guess point_ refers to a
certain accuracy that can be achieved by guessing a class which has the
highest frequency. The pseudocode for our implementation is shown in Algorithm
1. For more information about the architecture of the generators,
discriminators, and different hyperparameters used for multiple experiments,
please refer to our source code in the following repository:
_https://github.com/bishwasmandal246/uae-pupet_

###  III-A MNIST

This experiment considers the same setting as [16] and [45] where the private
attribute refers to whether the number is odd or even, while the utility
attribute encodes whether the number is $\geq 5$ or not. Fig. 1, shows the
original and privatized images generated by our privacy mechanism.We also
implemented our privacy mechanism using autoencoders (AE-PUPET), variational
autoencoders (VAE-PUPET), and $\beta$VAE [46] ($\beta$VAE-PUPET) to
demonstrate empirically that removing the Gaussian restrictions from the
latent variables (UAE-PUPET) is helpful in achieving better privacy and
utility guarantee i.e. low private attributes accuracy and high utility
attributes accuracy. Note that $\beta$VAE is an extension of VAE with
$\beta>1$ as the multiplier to the KL divergence term of VAE’s learning
objective. Table I illustrates the upper bound accuracy, and area-under
receiver operating characteristic curve (AUROC) results of our privacy
mechanism _UAE-PUPET_ , and its comparison to emb-g-filter of [16], AE-PUPET,
VAE-PUPET and $\beta$VAE-PUPET. The results for [16] are extracted from the
paper, where the authors only provide accuracy scores, and hence AUROC is kept
blank. Our proposed mechanism clearly outperforms emb-g-filter by achieving
2.6% less (absolute) accuracy on the private attribute and 11.2% higher
(absolute) accuracy on the utility attribute even when UAE-PUPET is tested
under multiple adversaries (weak adversary, strong adversary, and the
adversaries trained during the privacy mechanism training) whereas the emb-g-
filter of [16] is tested only under their original restrictive single
adversary model. Similarly, with our setup, it is clear to see the use of UAE
also provides better privacy and utility guarantees than that of AEs, VAEs or
$\beta$VAEs. Fig. 4 shows the UPT curve and compares different versions of
PUPET. Each point in the curve represents the mean of 25 experiments for a
particular $\lambda_{P}$ value. Note that the points in the upper-left (North-
West) regions are the most favorable.

Models | Private attr. | Utility attr.
---|---|---
accuracy | AUROC | accuracy | AUROC
without distortion(raw) | 0.98 | 0.98 | 0.98 | 0.98
emb-g-filter [16] | 0.651 | - | 0.855 | -
VAE-PUPET | 0.620 | 0.619 | 0.836 | 0.834
$\beta$VAE-PUPET | 0.6117 | 0.6119 | 0.8032 | 0.81
AE-PUPET | 0.654 | 0.657 | 0.964 | 0.964
UAE-PUPET | 0.625 | 0.622 | 0.967 | 0.967

TABLE I: MNIST accuracy and auroc results comparison

In Fig. 3, we provide a visualisation of latent variables before and after the
application of our privacy mechanism when the dimension of the latent variable
is two. The scatter plot does not have a closed structure because latent
variables are not required to follow a Gaussian distribution. In Fig. 3, we
can observe distinct regions in the two-dimensional space for the private
feature – even or odd, which makes the correct prediction of private feature
possible for the adversary. However, after applying the privacy mechanism, it
can be seen that the private feature – even or odd – doesn’t have distinct
regions in the two-dimensional space and the data points under a similar
region sometimes correspond to even and sometimes to odd, making the correct
prediction of the private feature difficult even for the _best performing
adversary_ – an adversary that classifies the private feature with the highest
accuracy.

(a) before UAE-PUPET (without distortion)

(b) after UAE-PUPET

Figure 3: MNIST: Latent geometry visualisation

(a) MNIST

(b) UCI Adult

(c) Fashion MNIST

(d) US Census

Figure 4: UPT Curves: Utility Privacy Tradeoff curves

Figure 5: UCI Adult: Different distributions of distortions after using UAE-
PUPET

###  III-B UCI Adult

In this experiment, we set our private feature as gender, and utility feature
as income. Data pre-processing steps include removing all the data points with
missing values, converting categorical variables to one-hot encoding
representations and normalizing all the variables. We compare our privacy
mechanism results to Variational Fair AutoEncoder (VFAE) [47], Lagrangian
Mutual Information-based Fair Representations (LMIFR) [48] and emb-g-filter
[16]. Similar to the MNIST experiment we also implement AE-PUPET, VAE-PUPET
and $\beta$VAE-PUPET. It is evident through Table II that our proposed method
UAE-PUPET has the least accuracy score of 0.6814, and AUROC score of 0.521 for
the private feature and comparable accuracy score of 0.822, and AUROC score of
0.72 for the utility feature even after being tested under multiple
adversaries. Fig. 4 shows that UAE-PUPET and AE-PUPET perform quite similarly
for this dataset. We should note that our implementation of AE-PUPET is almost
identical to that in [10], except their work considers alternative updates of
gradients, unlike ours.

Models | Private attr. | Utility attr.
---|---|---
accuracy | AUROC | accuracy | AUROC
without distortion(raw) | 0.83 | 0.75 | 0.84 | 0.76
VFAE [47] | 0.802 | 0.703 | 0.851 | 0.761
LMFIR [48] | 0.728 | 0.659 | 0.829 | 0.741
emb-g-filter [16] | 0.717 | 0.632 | 0.822 | 0.731
VAE-PUPET | 0.698 | 0.573 | 0.781 | 0.597
$\beta$VAE-PUPET | 0.696 | 0.58 | 0.782 | 0.607
AE-PUPET | 0.6819 | 0.525 | 0.821 | 0.71
UAE-PUPET | 0.6814 | 0.521 | 0.822 | 0.72

TABLE II: UCI Adult accuracy and AUROC result comparison

Recall that our privacy mechanism does not add external noise during training.
However, the regularization term provided by the discriminator losses when
updating the $\gamma$ parameters reflect a distortion. By not forcing any
specific noise distribution when training, the privacy mechanism has a higher
degree of freedom to produce different distributions of distortion on its own.
Fig. 5 illustrates the most common distortion distributions observed on the
UCI Adult dataset when privatizing using UAE-PUPET. The reason for the
appearance of different distributions has to do with multiple statistical
properties of the training data, which is an interesting area of research and
will be the subject of future work.

###  III-C Additional Results

Besides MNIST and UCI Adult, we also conduct experiments on Fashion MNIST and
US Census Demographic Data. These experiments employ private and utility
features that do not compare to any existing method; they are being presented
solely for the purpose of demonstrating how different PUPET models worsen the
adversaries’ results. For Fashion MNIST dataset, the private feature is the
identity of the fashion article (T-shirt/top, Trouser, Pullover, Dress, Coat,
etc.) and the utility feature is encoded on two labels: Upper (meaning
T-shirt/top, Pullover, Dress, Coat, Shirt) and Miscellaneous. Fig. 6, shows
the privatized images, along with their original versions. We see that the
privatized images appear to have been changed to different articles of
clothing. We also notice blurriness of privatized images, sometimes appearing
to be comprised of two different images juxtaposed on one. Our experiment
shows a drop of inference accuracy on private feature from 98% to 21% using
UAE-PUPET and AE-PUPET, 23% using VAE-PUPET, 41% using $\beta$VAE-PUPET under
_best performing adversary_ whereas the inference accuracy on the utility
feature decreases slightly from 99% to 96% using UAE-PUPET, 97% using AE-
PUPET, 82% using VAE-PUPET and 80% using $\beta$VAE-PUPET.

Figure 6: Fashion MNIST: Odd and even adjacent columns show original and
privatized versions (UAE-PUPET) respectively.

Similarly, US Census Demographic Data is the American Community Survey data
for 2017 that consists of 74,001 records for different counties. It has a
total of 37 features, out of which we select the sixteen features which are
highly correlated to each other, similar to the setting in [8]. Examples of
some of the selected features include the men population, women population,
population of citizens eligible to vote, per capita income, percentage of
population unemployed etc. Among the sixteen features, we select Employed as
the utility and Income as the private feature. Unlike [8], we further
categorize the utility feature into two labels i.e. $\leq 2000$ or $>2000$ and
private feature into two labels i.e. $\leq 55000$ or $>55000$ to make it a
balanced classification problem. All the other fourteen features are
continuous, and thus we normalize them based on their mean and standard
deviation. Similarly, we ignore data points that have missing values. We use a
total of 43,657 data points for training, and 29,105 data points for testing
purposes. Our experiments show that the accuracy for private features drops
down from 88% to 56% using UAE-PUPET, 58% using AE-PUPET, 68% using VAE-PUPET,
61% using $\beta$VAE-PUPET, and the utility accuracy drops from 92% to 90%
using UAE-PUPET, 87% using AE-PUPET and 80% using VAE-PUPET, and 79% using
$\beta$VAE-PUPET. This experiment again clearly shows better performance of
UAE-PUPET over other models. Please refer to Fig. 4 and Fig. 4 for the
complete comparison of these PUPET models.

###  III-D Data-Type-Aware Condition

In this section, we discuss the data-type-aware condition and its result. We
concentrate on the UCI Adult dataset since it is the only one out of four
datasets used, that contains categorical variables. The exponential mechanism
[49] in differential privacy is designed specifically for discrete/categorical
variables where classes are selected based on a scoring function. Similarly,
[50] proposed a noise addition technique to the categorical data. However,
these formulations solve different problem than ours. To the best of our
knowledge, the existing literature on using an adversarial learning framework
to solve the privacy-utility tradeoff problem does not discuss data-type-aware
conditions which is to say, correctly encoding the categorical feature as one
hot encoding that represents exactly one class, e.g.(a) (say [0, 0, 0, 1, 0])
after the distortion of data through the privacy mechanism. Instead, the
privacy mechanism outputs different probability values for each class, e.g.
(b) (say [0.1, 0.05, 0.03, 0.8, 0.02]) and this difference between (a) and (b)
is referred to as noise [10, 12, 16]. However, this notion of addition of
noise for categorical features is heavily flawed as the user cannot specify a
categorical variable as 10% of the first class, 5% of the second class, and so
on. Therefore, we formulate data-type-aware conditions which use the precise
representation of categorical variables before disclosing the data (refer to
Algorithm 1).

Finally, we discuss about the experimental results for data-type-aware
conditions on different versions of PUPET. Table III shows that, even when
enforcing constraints on the categorical variables, our PUPET models are
capable of providing similar privacy and utility guarantees compared to the
data-type-ignorant conditions. Additionally, we notice that UAE-PUPET and AE-
PUPET results are again very similar in performance. With more experiments we
observed that having small variance improves the performance slightly for this
dataset which explains the similarity in results for UAE and AE based PUPETs –
recall that with zero variance, UAE’s learning objective is same as AE’s.

Models | Private attr. | Utility attr.
---|---|---
accuracy | AUROC | accuracy | AUROC
without distortion(raw) | 0.83 | 0.75 | 0.84 | 0.76
VAE-PUPET | 0.6843 | 0.5806 | 0.7831 | 0.6272
$\beta$VAE-PUPET | 0.6791 | 0.53 | 0.771 | 0.5813
AE-PUPET | 0.6832 | 0.5414 | 0.8245 | 0.728
UAE-PUPET | 0.6817 | 0.5361 | 0.8220 | 0.7151

TABLE III: UCI Adult: data-type-aware conditions results

##  IV Conclusion

In this paper, we introduced a novel UAE-based privacy mechanism (UAE-PUPET),
and showed that it can attain better privacy-utility tradeoffs than the
existing works. Additionally, the results for AE-PUPET were found to be very
close to UAE-PUPET, but the use of VAE and $\beta$VAE showed poor results on
all the datasets. UAE-PUPET is still better than AE-PUPET in the sense that it
can behave like an AE-PUPET if required but the converse is not true. Better
overall results with UAE-PUPET and AE-PUPET imply that forcing a Gaussian
distribution on the latent variable of autoencoders (such as in VAE and
$\beta$VAE) appears to hinder the privacy mechanism. Our privacy mechanism is
focused on end-to-end stochastic mapping of input to the output. However, VAE
and $\beta$VAE have a KL-divergence term in their learning objective, which
deviates from only focusing on the reconstruction term. The results for VAE
and $\beta$VAE on UCI Adult is particularly poor because of the heterogeneous
nature of the data. [51] formulate VAEs to handle the heterogeneous nature of
data but this is a two stage process which adds complexity and is harder to
incorporate with our settings. Instead, the use of UAE helps deal with
heterogeneous data types, behaves like an AE if required, and can still add
randomness in the latent space like VAE and $\beta$VAE.

## References

  * [1] C. Dwork, “Differential privacy,” in _Automata, Languages and Programming_ , M. Bugliesi, B. Preneel, V. Sassone, and I. Wegener, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 1–12.
  * [2] C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” _Found. Trends Theor. Comput. Sci._ , vol. 9, no. 3–4, p. 211–407, Aug. 2014. [Online]. Available: https://doi.org/10.1561/0400000042
  * [3] L. Sweeney, “k-anonymity: A model for protecting privacy.” _International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems_ , vol. 10, no. 5, pp. 557–570, 2002. [Online]. Available: http://dblp.uni-trier.de/db/journals/ijufks/ijufks10.html#Sweene02
  * [4] S. R. Rajagopalan, L. Sankar, S. Mohajer, and H. V. Poor, “Smart meter privacy: A utility-privacy framework,” _2011 IEEE International Conference on Smart Grid Communications (SmartGridComm)_ , Oct 2011. [Online]. Available: http://dx.doi.org/10.1109/SmartGridComm.2011.6102315
  * [5] M. S. Alvim, M. E. Andrés, K. Chatzikokolakis, P. Degano, and C. Palamidessi, “Differential privacy: on the trade-off between utility and information leakage,” in _International Workshop on Formal Aspects in Security and Trust_. Springer, 2011, pp. 39–54.
  * [6] A. Makhdoumi and N. Fawaz, “Privacy-utility tradeoff under statistical uncertainty,” _2013 51st Annual Allerton Conference on Communication, Control, and Computing (Allerton)_ , pp. 1627–1634, 2013.
  * [7] L. Sankar, S. Rajagopalan, and H. Poor, “Utility-privacy tradeoffs in databases: An information-theoretic approach,” _IEEE Transactions on Information Forensics and Security_ , vol. 8, no. 6, pp. 838–852, 2013, copyright: Copyright 2013 Elsevier B.V., All rights reserved.
  * [8] C. Sharma, B. Mandal, and G. Amariucai, “A practical approach to navigating the tradeoff between privacy and precise utility,” in _ICC 2021 - IEEE International Conference on Communications_ , 2021, pp. 1–6.
  * [9] J. Domingo-Ferrer and V. Torra, “A critique of k-anonymity and some of its enhancements,” in _2008 Third International Conference on Availability, Reliability and Security_ , 2008, pp. 990–993.
  * [10] H. Edwards and A. Storkey, “Censoring representations with an adversary,” 2016\.
  * [11] C. Huang, P. Kairouz, X. Chen, L. Sankar, and R. Rajagopal, “Context-aware generative adversarial privacy,” _Entropy_ , vol. 19, no. 12, 2017. [Online]. Available: https://www.mdpi.com/1099-4300/19/12/656
  * [12] D. Madras, E. Creager, T. Pitassi, and R. Zemel, “Learning adversarially fair and transferable representations,” 2018.
  * [13] F. Pittaluga, S. J. Koppal, and A. Chakrabarti, “Learning privacy preserving encodings through adversarial training,” 2018.
  * [14] S. A. Osia, A. Taheri, A. S. Shamsabadi, K. Katevas, H. Haddadi, and H. R. Rabiee, “Deep private-feature extraction,” _IEEE Transactions on Knowledge and Data Engineering_ , vol. 32, no. 1, pp. 54–66, 2020.
  * [15] C. Huang, P. Kairouz, X. Chen, L. Sankar, and R. Rajagopal, “Generative adversarial privacy,” 2019.
  * [16] X. Chen, T. Navidi, S. Ermon, and R. Rajagopal, “Distributed generation of privacy preserving data with user customization,” 2019.
  * [17] Z. Wu, Z. Wang, Z. Wang, and H. Jin, “Towards privacy-preserving visual recognition via adversarial training: A pilot study,” 2020.
  * [18] A. Morales, J. Fierrez, R. Vera-Rodriguez, and R. Tolosana, “Sensitivenets: Learning agnostic representations with application to face images,” 2020.
  * [19] T. Xiao, Y.-H. Tsai, K. Sohn, M. Chandraker, and M.-H. Yang, “Adversarial learning of privacy-preserving and task-oriented representations,” _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 34, no. 07, pp. 12 434–12 441, Apr. 2020. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/article/view/6930
  * [20] E. Erdemir, P. L. Dragotti, and D. Gunduz, “Active privacy-utility trade-off against a hypothesis testing adversary,” 2021.
  * [21] Z. Wu, H. Wang, Z. Wang, H. Jin, and Z. Wang, “Privacy-preserving deep action recognition: An adversarial learning framework and a new dataset,” 2021.
  * [22] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” 2014.
  * [23] I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial networks,” 2014.
  * [24] Y. Ganin and V. Lempitsky, “Unsupervised domain adaptation by backpropagation,” 2015.
  * [25] J. Hamm and Y.-K. Noh, “K-beam minimax: Efficient optimization for deep adversarial learning,” in _Proceedings of the 35th International Conference on Machine Learning_ , ser. Proceedings of Machine Learning Research, J. Dy and A. Krause, Eds., vol. 80. PMLR, 10–15 Jul 2018, pp. 1881–1889. [Online]. Available: https://proceedings.mlr.press/v80/hamm18a.html
  * [26] J. Chen, J. Konrad, and P. Ishwar, “Vgan-based image representation learning for privacy-preserving facial expression recognition,” 2018.
  * [27] N. Raval, A. Machanavajjhala, and J. Pan, “Olympus: Sensor privacy through utility aware obfuscation,” _Proceedings on Privacy Enhancing Technologies_ , vol. 2019, no. 1, pp. 5–25, 2019. [Online]. Available: https://doi.org/10.2478/popets-2019-0002
  * [28] I. Ilanchezian, P. Vepakomma, A. Singh, O. Gupta, G. N. S. Prasanna, and R. Raskar, “Maximal adversarial perturbations for obfuscation: Hiding certain attributes while preserving rest,” 2019.
  * [29] H. Hsu, S. Asoodeh, and F. Calmon, “Obfuscation via information density estimation,” in _Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics_ , ser. Proceedings of Machine Learning Research, S. Chiappa and R. Calandra, Eds., vol. 108. PMLR, 26–28 Aug 2020, pp. 906–917. [Online]. Available: https://proceedings.mlr.press/v108/hsu20a.html
  * [30] N. Raval, A. Machanavajjhala, and L. P. Cox, “Protecting visual secrets using adversarial nets,” _2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)_ , pp. 1329–1332, 2017.
  * [31] A. Grover and S. Ermon, “Uncertainty autoencoders: Learning compressed representations via variational information maximization,” 2019.
  * [32] Y. LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” _ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist_ , vol. 2, 2010.
  * [33] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” 2017.
  * [34] D. Dua and C. Graff, “UCI machine learning repository,” 2017. [Online]. Available: http://archive.ics.uci.edu/ml
  * [35] “US Census Demographic Data,” https://www.kaggle.com/muonneutrino/
us-census-demographic-data#acs2017_census_tract_data.csv, Last accessed on
2020-4-24.

  * [36] S. Asoodeh, F. Alajaji, and T. Linder, “On maximal correlation, mutual information and data privacy,” in _2015 IEEE 14th Canadian Workshop on Information Theory (CWIT)_. IEEE, 2015, pp. 27–31.
  * [37] M. A. Erdogdu and N. Fawaz, “Privacy-utility trade-off under continual observation,” in _2015 IEEE International Symposium on Information Theory (ISIT)_. IEEE, 2015, pp. 1801–1805.
  * [38] H. Wang and F. P. Calmon, “An estimation-theoretic view of privacy,” in _2017 55th Annual Allerton Conference on Communication, Control, and Computing (Allerton)_. IEEE, 2017, pp. 886–893.
  * [39] K. Kalantari, L. Sankar, and O. Kosut, “On information-theoretic privacy with general distortion cost functions,” in _2017 IEEE International Symposium on Information Theory (ISIT)_. IEEE, 2017, pp. 2865–2869.
  * [40] Y. O. Basciftci, Y. Wang, and P. Ishwar, “On privacy-utility tradeoffs for constrained data release mechanisms,” in _2016 Information Theory and Applications Workshop (ITA)_. IEEE, 2016, pp. 1–6.
  * [41] H. Wang, M. Diaz, F. P. Calmon, and L. Sankar, “The utility cost of robust privacy guarantees,” in _2018 IEEE International Symposium on Information Theory (ISIT)_. IEEE, 2018, pp. 706–710.
  * [42] B. Rassouli and D. Gündüz, “Optimal utility-privacy trade-off with total variation distance as a privacy measure,” _IEEE Transactions on Information Forensics and Security_ , vol. 15, pp. 594–603, 2019.
  * [43] M. Diaz, H. Wang, F. P. Calmon, and L. Sankar, “On the robustness of information-theoretic privacy measures and mechanisms,” _IEEE Transactions on Information Theory_ , vol. 66, no. 4, pp. 1949–1978, 2019.
  * [44] P.-T. de Boer, D. P. Kroese, S. Mannor, and R. Y. Rubinstein, “A tutorial on the cross-entropy method,” _ANNALS OF OPERATIONS RESEARCH_ , vol. 134, 2004\.
  * [45] A. Rezaei, C. Xiao, J. Gao, B. Li, and S. Munir, “Application-driven privacy-preserving data publishing with correlated attributes,” _arXiv preprint arXiv:1812.10193_ , 2018.
  * [46] I. Higgins, L. Matthey, A. Pal, C. P. Burgess, X. Glorot, M. M. Botvinick, S. Mohamed, and A. Lerchner, “beta-vae: Learning basic visual concepts with a constrained variational framework,” in _ICLR_ , 2017.
  * [47] C. Louizos, K. Swersky, Y. Li, M. Welling, and R. Zemel, “The variational fair autoencoder,” 2017.
  * [48] J. Song, P. Kalluri, A. Grover, S. Zhao, and S. Ermon, “Learning controllable fair representations,” _CoRR_ , vol. abs/1812.04218, 2018. [Online]. Available: http://arxiv.org/abs/1812.04218
  * [49] F. McSherry and K. Talwar, “Mechanism design via differential privacy,” in _48th Annual IEEE Symposium on Foundations of Computer Science (FOCS’07)_ , 2007, pp. 94–103.
  * [50] H. Giggins and L. Brankovic, “Vicus: A noise addition technique for categorical data,” in _Proceedings of the Tenth Australasian Data Mining Conference - Volume 134_ , ser. AusDM ’12. AUS: Australian Computer Society, Inc., 2012, p. 139–148.
  * [51] C. Ma, S. Tschiatschek, J. M. Hernández-Lobato, R. Turner, and C. Zhang, “Vaem: a deep generative model for heterogeneous mixed type data,” 2020. [Online]. Available: https://arxiv.org/abs/2006.11941


# Maximal discrete subgroups in unitary groups
of operator algebras

Vadim Alekseev  Vadim Alekseev, TU Dresden, Germany  vadim.alekseev@tu-
dresden.de and  Andreas Thom  Andreas Thom, TU Dresden, Germany
<EMAIL_ADDRESS>
###### Abstract.

We show that if a group $G$ is mixed-identity-free, then the projective
unitary group of its group von Neumann algebra contains a maximal discrete
subgroup containing $G$. The proofs are elementary and make use of free
probability theory. In addition, we clarify the situation for
$C^{*}$-algebras.

###### 2020 Mathematics Subject Classification:

46L10, 22E40, 20F38.

##  1\. Introduction

It has been of interest since the beginning of the theory of topological
groups to study discrete subgroups for familiar topological groups, such as
connected Lie groups or other locally compact groups arising from arithmetic
or geometry [MR29918, MR374340, MR0209363, MR212021, MR2198218, MR41145,
MR171781]. Of special interest is the question if a discrete subgroup is
maximal among discrete subgroups, i.e. when every group containing it properly
is not discrete, or if, at least, it is contained in a maximal discrete
subgroup. For ${\rm PU}(n)$, the Jordan–Schur theorem states that any discrete
(and hence finite) subgroup has an abelian normal subgroup of uniformly
bounded index. This implies that some finite subgroups are contained in
maximal discrete subgroups – we will clarify the situation in Proposition 4.3.
This realm of questions becomes even more interesting for non-compact groups.
For example, Helling’s theorem [MR228437] states that a maximal discrete
subgroup of ${\rm PSL}(2,\mathbb{R})$ that is commensurable with ${\rm
PSL}(2,\mathbb{Z})$ is conjugate to a congruence subgroup $\Gamma^{+}_{0}(N)$
for some square-free integer $N$. In [MR2198218], Belolipetsky and Lubotzky
provided examples of maximal discrete subgroups of the isometry group of
higher-dimensional hyperbolic space arising as commensurators of certain non-
arithmetic lattices.

Typical existence results of maximal discrete subgroups usually show that the
family of discrete subgroups is uniformly discrete and employ some contraction
mechanism near the identity element, for example in the usual operator norm on
${\rm GL}(n,\mathbb{C})$

$\|1-uvu^{-1}v^{-1}\|\leq 2\|1-u\|\|1-v\|\|u^{-1}\|\|v^{-1}\|.$

Any result like this provides a tool to construct smaller and smaller elements
in a group once it gets close enough to the unit element. If the group is
assumed to be discrete in addition one obtains nilpotency phenomena near the
identity. More precisely, there is the following classical result of
Zassenhaus [MR3069692] which says in modern form: If $G$ is a semisimple Lie
group there exists a neighbourhood $\Omega$ of the identity in $G$ and a
constant $C>0$, such that any discrete subgroup $\Gamma$ which is generated by
$\Gamma\cap\Omega$ contains a nilpotent subgroup of index bounded by $C$. This
has been generalized by Margulis to cover isometry groups of spaces of
negative sectional curvature.

The situation is much different in the non-locally compact setting, but a
similar reasoning works for example in the unitary group of say a
$C^{*}$-algebra and hinges only on submultiplicativity of the norm which
implies contractivity of the commutator map near the unit. Again, this implies
by a Zassenhaus argument that any discrete subgroup $\Gamma$ of the unitary
group of a $C^{*}$-algebra $A$ satisfies that the group generated by the set
$\\{g\in\Gamma\mid\|1-g\|<1/2\\}$ is abelian and normal, see Theorem 4.1.
Nothing is known about the concrete examples of maximal discrete subgroups.

We aim to study this phenomenon in the context of finite von Neumann algebras,
where the unitary group is metrized by the $2$-norm and no contractivity of
the commutator map is available in general. We will make use of free
probability theory to overcome this problem in the situation of the group von
Neumann algebra $LG$, and show in many cases that nevertheless the class of
discrete subgroups of the projective unitary group ${\rm PU}(LG)$ containing
$G$ is uniformly discrete. As a consequence, $G$ is contained in a maximal
discrete subgroup. We do not know if or when $G\subset{\rm PU}(LG)$ is maximal
discrete itself.

##  2\. Preparations using free probability

Let $(M,\tau)$ be a finite von Neumann algebra and we will typically assume
that it is a ${\rm II}_{1}$-factor. The $2$-norm on $M$ is defined as
$\|x\|_{2}=\tau(x^{*}x)^{1/2}$. We denote its unitary group by ${\rm U}(M)$
and its projective unitary group by ${\rm PU}(M):={\rm U}(M)/S^{1}$. Consider
unitaries $u,v\in{\rm U}(M)$ which are freely independent, that is to say that
they lie in freely independent subalgebras in the sense of Voiculescu
[MR1217253]. We set $\alpha:=\tau(u)$ and $\beta:=\tau(v)$. Note that because
of freeness we have

$0=\tau((u-\alpha)(v-\beta))=\tau(uv)-\beta\tau(u)-\alpha\tau(v)+\alpha\beta$

and hence $\tau(uv)=\tau(u)\tau(v)$ for any freely independent pair of
unitaries $u,v\in{\rm U}(M)$. We aim to compute the trace of $uvu^{*}v^{*}$.
Again, by freeness, we obtain:

$\displaystyle 0$ $\displaystyle=$
$\displaystyle\tau((u-\alpha)(v-\beta)(u^{*}-\bar{\alpha})(v^{*}-\bar{\beta}))$
$\displaystyle=$
$\displaystyle\tau(uvu^{*}v^{*})-\alpha\tau(vu^{*}v^{*})-\beta\tau(uu^{*}v^{*})-\bar{\alpha}\tau(uvv^{*})-\bar{\beta}\tau(uvu^{*})$
$\displaystyle+\alpha\beta\tau(u^{*}v^{*})+|\alpha|^{2}\tau(vv^{*})+\alpha\bar{\beta}\tau(vu^{*})+\bar{\alpha}\beta\tau(uv^{*})+|\beta|^{2}\tau(uu^{*})+\bar{\alpha}\bar{\beta}\tau(uv)$
$\displaystyle-|\alpha|^{2}\beta\tau(v^{*})-\alpha|\beta|^{2}\tau(u^{*})-|\alpha|^{2}\bar{\beta}\tau(v)-\bar{\alpha}|\beta|^{2}\tau(u)+|\alpha|^{2}|\beta|^{2}$
$\displaystyle=$
$\displaystyle\tau(uvu^{*}v^{*})-2|\alpha|^{2}-2|\beta|^{2}+4|\alpha|^{2}|\beta|^{2}+|\alpha|^{2}+|\beta|^{2}-4|\alpha|^{2}|\beta|^{2}+|\alpha|^{2}|\beta|^{2}$
$\displaystyle=$
$\displaystyle\tau(uvu^{*}v^{*})-|\alpha|^{2}-|\beta|^{2}+|\alpha|^{2}|\beta|^{2}.$

Hence, we conclude that

$\tau(uvu^{*}v^{*})=|\alpha|^{2}+|\beta|^{2}-|\alpha|^{2}|\beta|^{2}=1-(1-|\tau(u)|^{2})(1-|\tau(v)|^{2})$

for any freely independent pair of unitaries $u,v\in{\rm U}(M)$. On ${\rm
U}(M)$, we consider the length function
$\ell(u):=\|1-u\|_{2}=\sqrt{2-2\Re(\tau(u))}$. Since

$(1-|\tau(u)|^{2})=(1+|\tau(u)|)(1-|\tau(u)|)\leq 2(1-|\tau(u)|)\leq
2-2\Re(\tau(u))=\ell(u)^{2},$

we obtain

$\displaystyle\ell([u,v])$ $\displaystyle=$
$\displaystyle\sqrt{2-2\Re(\tau(uvu^{*}v^{*}))}$ $\displaystyle=$
$\displaystyle\sqrt{2(1-|\tau(u)|^{2})(1-|\tau(v)|^{2})}$ $\displaystyle\leq$
$\displaystyle\sqrt{2}\cdot\ell(u)\ell(v)$

for any freely independent pair of unitaries $u,v\in{\rm U}(M)$. With only
little more work, we also obtain a lower bound for $\ell([u,v])$. Indeed,
define the projective length function

$\bar{\ell}(u)=\inf_{|\lambda|=1}\|\lambda-u\|_{2}=\sqrt{2(1-|\tau(u)|)},$

which metrizes ${\rm PU}(M)$ in a natural way. Note that $\mu-\mu^{2}/4\geq
1/2\cdot\mu$ for $\mu\in[0,2]$. If $u,v$ are freely independent unitaries, we
get:

$\displaystyle\ell([u,v])^{2}$ $\displaystyle=$ $\displaystyle
2(1-\Re\tau([u,v]))$ $\displaystyle=$ $\displaystyle
2(1-|\tau(u)|^{2})(1-|\tau(v)|^{2})$ $\displaystyle=$ $\displaystyle
2(1-(1-\bar{\ell}(u)^{2}/2)^{2})(1-(1-\bar{\ell}(v)^{2}/2)^{2}$
$\displaystyle=$ $\displaystyle
2(\bar{\ell}(u)^{2}-\bar{\ell}(u)^{4}/4)(\bar{\ell}(v)^{2}-\bar{\ell}(v)^{4}/4)$
$\displaystyle\geq$ $\displaystyle 2(1/2)^{2}\cdot\ell(u)^{2}\ell(v)^{2}$

Hence, we conclude that

$\ell([u,v])\geq 1/\sqrt{2}\cdot\bar{\ell}(u)\bar{\ell}(v)$

and we may summarize the computations as follows:

######  Theorem 2.1.

Let $u,v\in{\rm U}(M)$ be freely independent unitaries. Then, we have

$1/\sqrt{2}\cdot\bar{\ell}(u)\bar{\ell}(v)\leq\bar{\ell}([u,v])=\ell([u,v])\leq\sqrt{2}\cdot\bar{\ell}(u)\bar{\ell}(v)\leq\sqrt{2}\cdot\ell(u)\ell(v).$

For the rest of the paper we fix a sequence of words $(w_{n})_{n}$ in
$F_{2}=\langle x,y\rangle$ such that $w_{1}=x$ and inductively
$w_{n+1}=[w_{n},y^{n}xy^{-n}],$ i.e.
$w_{2}=[x,yxy^{-1}],w_{3}=[[x,yxy^{-1}],y^{2}xy^{-2}],$ and so on. If $u,v$
are freely independent and $v$ is a Haar unitary (i.e. a unitary with
$\tau(v^{n})=0$ for all $n\in\mathbb{Z}\setminus\\{0\\}$), it is easy to see
that $u,vuv^{*},v^{2}u(v^{*})^{2},\dots,$ are freely independent too. We
consider the sequence $(w_{n}(u,v))_{n}$, for $i\in\mathbb{N}$, i.e.

$u_{1}=u,u_{2}=[u,vuv^{*}],u_{3}=\left[[u,vuv^{*}],v^{2}u(v^{*})^{2}\right],\dots.$

Thus, we obtain from the previous theorem by induction

$(1/\sqrt{2})^{n-1}\cdot\bar{\ell}(u)^{n}\leq\ell(w_{n}(u,v))\leq(\sqrt{2})^{n-1}\cdot\ell(u)^{n}.$

The upper bound was rather surprising for us at first, since
$\ell(u)<1/\sqrt{2}$ does not seem to be a severe assumption and we may assume
in addition that the subgroup generated by $u$ in ${\rm PU}(M)$ is discrete,
we may even assume that $u^{\prime}$ is a Haar unitary in a corner $pMp$ and
$u=u^{\prime}+p^{\perp}$ for a projection $p$ with $\tau(p)<1/4$.

######  Corollary 2.2.

Let $M$ be a tracial von Neumann algebra. Let $u,v\in{\rm U}(M)$ be freely
independent unitaries with $\ell(u)<1/\sqrt{2}$ and $v$ a Haar unitary. For
every $\varepsilon>0$, there exists $w\in\mathbb{F}_{2}$, such that
$\ell(w(u,v))<\varepsilon$.

######  Corollary 2.3.

Let $M$ be a separable ${\rm II}_{1}$-factor. There exists a hyperfinite ${\rm
II}_{1}$-factor $R\subset M$ and Haar unitaries $v_{1},\dots,v_{n},\dots$ in
${\rm U}(R)$ such that the following holds. For every $u\in{\rm U}(M)$
satisfying $\ell(u)<1/\sqrt{2}$ and for every $\varepsilon>0$, there exists
$w\in F_{2}$ and $n\in\mathbb{N}$ such that $\ell(w(u,v_{n}))<\varepsilon$.

###### Proof.

By work of Popa [MR1372533], we may assume that $R^{\prime}\cap M=\mathbb{C}$
and that $v=[(v_{n})_{n}]\in{\rm U}(M^{\omega})$ is free from $M$ inside
$M^{\omega}$. Now apply the previous theorem and pass to some $v_{n}$ along
the ultralimit. ∎

######  Remark 2.4.

Sources of increasing sequences of discrete groups in ${\rm PU}(M)$ that
become less and less discrete come from many sources. For example, it is easy
to see that $\mathbb{Z}\subset{\rm PU}(L\mathbb{Z})$ is not maximal discrete,
in fact ${\rm U}(L\mathbb{Z})$ does not admit a maximal discrete subgroup at
all. Another example is $\cup_{n}{\rm Sym}(2^{n})\subset{\rm
U}(\otimes_{n}M_{2}(\mathbb{C}))$. More artificially, we may consider ${\rm
U}(LF_{2})$ and pick a partition of $1$ into orthogonal projections
$(p_{n})_{n}$ of trace $2^{-n}$. Then

$\prod_{n\geq 1}{\rm U}((LF_{2})_{2^{-n}})\subset{\rm U}(LF_{2})$

and $(LF_{2})_{2^{-n}}=LF_{1+2^{2n}}$ by results of Voiculescu [MR1217253], so
that $\bigoplus_{n\geq 1}F_{1+2^{2n}}$ is a subgroup of ${\rm U}(LF_{2})$.
This last example also shows clearly, that there is no reason to expect any
form of commutator contractivity near the identity in general.

##  3\. Applications to group von Neumann algebras

We will now turn our attention to group von Neumann algebras. Let $G$ be a
group. A sequence $(g_{n})_{n}$ of elements in $G$ is called asymptotically
free if $(g_{n})_{n}$ is free from the diagonal copy of $G$ in $\prod_{n}G$.
Equivalently, for every $k\in\mathbb{N}$, $s_{1},\dots,s_{k}\in
G\setminus\\{1\\}$ and every
$\varepsilon_{1},\dots,\varepsilon_{k}\in\mathbb{Z}\setminus\\{0\\}$, there
exists $n\in\mathbb{N}$, such that

$s_{1}g_{n}^{\varepsilon_{1}}s_{2}g_{n}^{\varepsilon_{2}}s_{3}\cdots
g_{n}^{\varepsilon_{k}}\neq 1$

Groups admitting an asymptotically free sequence have been studied for a long
time.

Recall that a mixed identity for $G$ is a word $w\in\mathbb{Z}\ast G=\langle
G,t\rangle$ in one variable $t$ with coefficients in $G$ such that $w$
evaluates to the identity if any element of $G$ is substituted for $t$. A
group is called mixed identity free (MIF) if it does not satisfy any non-
trivial mixed identity. We refer the reader to [MR3556970] for further details
around this notion, emphasizing the following statement.

######  Proposition 3.1 ([MR3556970, proof of Proposition 5.3 and Remark
5.1]).

Let $G$ be a group. The following are equivalent:

  1. (1)

The group $G$ contains an asymptotically free sequence.

  2. (2)

There is no mixed identity $w\in\mathbb{Z}\ast G$ for $G$.

  3. (3)

$G$ is mixed identity free, i.e. there exists no mixed identity in
$\mathbb{F}_{\infty}\ast G$.

We denote the group von Neumann algebra of $G$ with its natural trace by
$(LG,\tau)$. It is well-known that any non-trivial conjugacy class in a ${\rm
MIF}$ group is infinite. In particular, the group von Neumann algebra $LG$ of
a ${\rm MIF}$ group $G$ is a ${\rm II}_{1}$-factor. Note that the left-regular
representation provides a natural inclusion $G\subset{\rm PU}(LG)$. We will be
interested in the existence if maximal discrete subgroups of ${\rm PU}(LG)$
containing $G$.

######  Lemma 3.2.

Let $(g_{n})_{n}$ be an asymptotically free sequence. There exists an
ultrafilter $\omega$, such that $[(g_{n})_{n}]\in U((LG)^{\omega})$ is freely
independent from the diagonal copy of $LG$ in $(LG)^{\omega}$.

This lemma is standard but not completely trivial, and we include the argument
for the sake of completeness.

###### Proof.

Let $(w_{m})$ be an enumeration of all mixed identities, that is, elements in
$\mathbb{Z}\ast G$. We denote by $w(m_{1},\dots,m_{\ell})$ the iterated
commutator

$w(m_{1},\dots,m_{\ell})=[w_{m_{1}},[w_{m_{2}},\dots[w_{m_{\ell-1}},w_{m_{\ell}}]]].$

Observe that if $w(m_{1},\dots,m_{\ell})(g)\neq 1$, it guarantees that
$w_{m_{i}}(g)\neq 1$ for all $i=1,\dots,\ell$. Let $v_{\ell}\coloneqq
w(1,2,\dots,\ell)$. Asymptotic freeness of $(g_{n})$ guarantees the existence
of natural numbers $n_{\ell}$ such that $v_{\ell}(g_{n_{\ell}})\neq 1$. Taking
an ultrafilter containing this sequence finishes the proof. ∎

######  Lemma 3.3.

Let $G$ be a ${\rm MIF}$ group and $u\in{\rm U}(LG)$ with $u\not\in S^{1}\cdot
1$ and $\Re(\tau(u))>3/4$. For any $\varepsilon>0$ there exists some
$w\in\mathbb{F}_{2}$ and $g\in G$ such that $\ell(w(u,g))<\varepsilon$.
Moreover, the image of the map from $\mathbb{Z}\ast G$ to ${\rm PU}(LG)$ that
maps the generator $1\in\mathbb{Z}$ to $u$ is not discrete.

###### Proof.

Note that from the assumptions $\bar{\ell}(u)\neq 0$ and $\ell(u)<\sqrt{2}$.
Let $(g_{k})_{k}$ be an asymptotically free sequence and set
$v=[(g_{k})_{k}]\in(LG)^{\omega}$. By assumption $\ell(u)\leq
1/\sqrt{2}-\delta$ for some $\delta>0$. By the results from above, we get

$(1/\sqrt{2})^{n-1}\cdot\bar{\ell}(u)^{n}\leq\ell(w_{n}(u,v))\leq(\sqrt{2})^{n-1}\cdot\ell(u)^{n}.$

Thus, for some $k\in\mathbb{N}$

$(1/\sqrt{2})^{n}\cdot\bar{\ell}(u)^{n}\leq\ell(w_{n}(u,g_{k}))\leq(\sqrt{2})^{n}\cdot\ell(u)^{n}$

and this finishes the proof. ∎

The following consequence is immediate.

######  Corollary 3.4.

Let $G$ be a ${\rm MIF}$ group and let $u\in{\rm PU}(LG)$ with
$0<\bar{\ell}(u)<1/\sqrt{2}$. Then, the subgroup $\langle
u,G\rangle\subset{\rm PU}(LG)$ is not discrete. In particular, the set of
discrete subgroups of ${\rm PU}(LG)$ containing $G$ is uniformly discrete.

###### Proof.

By the previous lemma, no such subgroup contains a non-trivial element with
$\bar{\ell}(u)<1/\sqrt{2}$. Indeed, we would apply the previous lemma to a
suitable lift $u^{\prime}$ with $\ell(u^{\prime})<1/\sqrt{2}$.∎

We are now able to state and prove our main result.

######  Theorem 3.5.

Let $G$ be a ${\rm MIF}$ group. Then, $G$ is contained in a maximal discrete
subgroup in ${\rm PU}(LG)$.

###### Proof.

The discrete subgroups of ${\rm PU}(LG)$ containing $G$ are ordered by
inclusion. Now, the result follows by Zorn’s lemma since unions over chains
remain discrete. ∎

######  Corollary 3.6.

Let $R$ be the hyperfinite ${\rm II}_{1}$-factor. The group ${\rm PU}(R)$
contains a maximal discrete subgroup.

###### Proof.

It is known by results of Hull and Osin [MR3556970] that there are amenable
${\rm MIF}$ groups. Any ${\rm MIF}$ group is automatically an i.c.c. group
(that is, it has only infinite non-trivial conjugacy classes). See also
[MR4193626] for an example of an elementary amenable group that is ${\rm
MIF}$. Since $LG=R$ in the i.c.c. amenable case by Connes [MR454659], this
finishes the proof. ∎

######  Question 3.7.

When is $G\subset{\rm PU}(LG)$ a maximal discrete subgroup?

Due to existence of central subgroups, the preceding question is only
interesting for i.c.c. groups. However, we do not have a single i.c.c. group,
where we could decide this question.

##  4\. Miscellaneous results

In this section, we start out by briefly discussing maximal discrete subgroups
in unitary groups of $C^{*}$-algebras. The following result is in analogy to
the Jordan-Schur theorem mentioned in the introduction.

######  Theorem 4.1.

Let $A$ be a unital $C^{*}$-algebra and $\Gamma$ be a discrete subgroup of its
unitary group ${\rm U}(A)$. Then, the subgroup

$\Gamma_{1/2}=\langle g\in\Gamma\mid\|1-g\|<1/2\rangle$

is abelian and normal in $\Gamma$.

###### Proof.

We set $\ell(g)=\|1-g\|$ and note that

$\displaystyle\ell([g,h])$ $\displaystyle=$
$\displaystyle\|1-ghg^{*}h^{*}\|=\|hg-gh\|$ $\displaystyle=$
$\displaystyle\|(1-h)(1-g)-(1-g)(1-h)\|\leq 2\|1-g\|\|1-h\|=2\ell(g)\ell(h).$

We define $\Gamma_{t}:=\langle g\in\Gamma\mid\ell(g)<t\rangle$. Fix
$\varepsilon>0$ and set

$\delta=\inf\\{\ell(g)\mid g\in\Gamma_{1/2-\varepsilon}\mbox{ is not central
in }\Gamma_{1/2-\varepsilon}\\}.$

Suppose that this infimum is positive and finite, i.e. that the set of non-
central elements is bounded away from $1$ and non-empty. If $g$ is non-central
in $\Gamma_{1/2-\varepsilon}$, then it cannot commute with the entire
generating set of $\Gamma_{1/2-\varepsilon}$. Thus, we can consider
$g,h\in\Gamma_{1/2-\varepsilon}$ with $\ell(g)<(1+2\varepsilon)\delta$,
$\ell(h)<1/2-\varepsilon$ and $[g,h]\neq 1$. We compute

$\ell([g,h])\leq 2(1+2\varepsilon)\delta(1/2-\varepsilon)<\delta$

and hence $[g,h]$ is central in $\Gamma_{1/2-\varepsilon}$, in particular, it
commutes with $g$ and $h$. Thus, we obtain a unitary representation of the
Heisenberg group

$H(\mathbb{Z})=\langle x,y,z\mid[x,y]=z,[x,z]=[y,z]=1\rangle.$

But for any unitary representation of the Heisenberg group for which $z$ acts
non-trivially, both generators are far away from the identity. Indeed,
irreducible unitary representations are parametrised by $\theta\in S^{1}$ and
either lead to the unique irreducible representation of the non-commutative
torus $A_{\theta}$ or they are finite-dimensional and completely understood.
In any case, the generators satisfy $\|1-g\|\geq\sqrt{3}$ and
$\|1-h\|\geq\sqrt{3}$ unless they commute. This implies that
$\Gamma_{1/2-\varepsilon}$ is abelian. Since $\varepsilon>0$ was arbitrary and

$\Gamma_{1/2}=\bigcup_{\varepsilon>0}\Gamma_{1/2-\varepsilon},$

this finishes the proof. ∎

The following corollary is immediate.

######  Corollary 4.2.

Let $A$ be a unital $C^{*}$-algebra and $\Gamma\subset{\rm U}(A)$ be a
discrete subgroup. Then, at least one of two conditions are satisfied:

  1. (1)

The set of discrete subgroups containing $\Gamma$ is uniformly discrete. In
particular, the group $\Gamma$ is contained in a maximal discrete subgroup.

  2. (2)

The group $\Gamma$ normalizes a non-trivial abelian subalgebra of $A$, and
there exists an ascending chain of subgroups of $U(A)$ containing $\Gamma$,
which is not uniformly discrete.

It is natural to wonder about maximal finite subgroups of compact Lie groups,
most notably of ${\rm PU}(n)$. The following result is elementary and surely
known to experts.

######  Proposition 4.3.

Let $G$ be a finite group. Let $\pi\colon G\to{\rm SU}(n)$ be a non-trivial
irreducible representation and let $\bar{\pi}\colon G\to{\rm PU}(n)$ be the
corresponding projective representation. Assume that $\pi(G)$ does not
normalize a non-trivial torus in ${\rm SU}(n)$, equivalently, every
$\pi(G)$-invariant abelian Lie subalgebra of $\mathfrak{su}(n)$ is trivial. In
particular, this holds when $G$ does not admit a non-trivial homomorphism to
${\rm Sym}(n)$, or, more generally, when $\pi$ is non-trivial and irreducible
of least dimension.

Then, the set of discrete subgroups of ${\rm PU}(n)$ containing $\bar{\pi}(G)$
is uniformly discrete. In particular, $\bar{\pi}(G)$ is contained in a maximal
discrete subgroup.

###### Proof.

Assume that there exists a sequence of finite subgroups
$H_{0},H_{1},H_{2},\cdots$ containing $\pi(G)$ which is getting less and less
discrete in ${\rm SU}(n)$. By the Jordan–Schur theorem we get a sequence of
abelian normal subgroups $A_{i}\subset H_{i}$ of uniformly bounded index.
Consider an ultralimit $A$ of the sequence $(A_{i})_{i}$ in the space of
closed subgroups of ${\rm SU}(n)$ and let $A_{0}$ be the connected component
of the identity of $A$. Note that $A_{0}$ is normalized by $\pi(G)$. In order
to obtain a contradiction, we will show that $A_{0}$ is trivial. We denote the
Lie algebra of $A_{0}$ by $\mathfrak{a}$, which is naturally acted upon by the
group $G$. We conclude that $\mathfrak{a}$ is trivial and hence $A_{0}$ is
trivial. This finishes the proof.

For the proof of the addendum, note that ${\rm
dim}_{\mathbb{R}}(\mathfrak{a})\leq n-1$, so that if $\pi$ was irreducible of
least dimension, the action of $\pi(G)$ on $\mathfrak{a}$ must be trivial.
Thus, if $\mathfrak{a}$ is non-trivial, we obtain a non-scalar matrix
commuting with $\pi(G)$, contrary to our assumption that $\pi$ was
irreducible. ∎

Let us remark that by classification of finite subgroups of
$\rm{SO}(3)\cong\rm{PU}(2)$ the abelian rotation subgroup $\mathbb{Z}/n$ is
not contained in any maximal finite subgroup for $n>5$: the only finite
subgroups $\rm{SO}(3)$ which come in question are dihedral subgroups, and one
can always embed a dihedral subgroup into a bigger dihedral subgroup.

## Acknowledgments

This research was supported by the ERC Consolidator Grant No. 681207.

## References