$\mathbf{\widehat{x}}_{m}=g_{\bm{\theta}}(\mathbf{z}_{m}^{\mathsf{enc}}),\forall
m\in[M]$

11: Compute
$\mathbf{\widetilde{x}}_{m}=g_{\bm{\varphi}}(\mathbf{z}_{m}^{\mathsf{enc}},\mathbf{s}_{m}),\forall
m\in[M]$

12: Back-propagate loss:
$\quad\mathcal{L}\left(\bm{\phi},\bm{\theta},\bm{\varphi}\right)=\\!-\frac{1}{M}\sum_{m=1}^{M}\\!\Big{(}\mathsf{dis}(\mathbf{x}_{m},\mathbf{\widehat{x}}_{m})-\alpha\,\mathrm{D}_{\mathrm{KL}}\\!\left(P_{\bm{\phi}}(\mathbf{z}_{m}^{\mathsf{enc}}\\!\mid\\!\mathbf{x}_{m})\|Q_{\bm{\psi}}(\mathbf{z}_{m}^{\mathsf{prior}})\right)+\,\alpha\,\mathsf{dis}(\mathbf{x}_{m},\mathbf{\widetilde{x}}_{m})\Big{)}$
(35) (2) Train the Latent Space Discriminator $\bm{\eta}$

13: Sample $\\{\mathbf{x}_{m}\\}_{m=1}^{M}\sim P_{\mathsf{D}}(\mathbf{X})$

14: Sample $\\{\mathbf{n}_{m}\\}_{m=1}^{M}\sim\mathcal{N}(\bm{0},\mathbf{I})$

15: Compute $\mathbf{z}_{m}^{\mathsf{enc}}\\!$ from
$\\!f_{\\!\bm{\phi}}(\mathbf{x}_{m})\\!$ with reparametrization, $\forall
m\\!\in\\![M]\\!$

16: Compute $\mathbf{z}_{m}^{\mathsf{prior}}\\!\\!$ from
$\\!g_{\bm{\psi}}(\mathbf{n}_{m}\\!)\\!$ with reparametrization, $\\!\forall
m\\!\in\\![M]\\!$

17: Back-propagate loss:
$\;\;\;\mathcal{L}\left(\bm{\eta}\right)=-\frac{\alpha}{M}\;\sum_{m=1}^{M}\log
D_{\bm{\eta}}(\mathbf{z}_{m}^{\mathsf{enc}})+\log\big{(}1-D_{\bm{\eta}}(\,\mathbf{z}_{m}^{\mathsf{prior}}\,)\big{)}$
(3) Train the Encoder $\bm{\phi}$ and Prior Distribution Generator $\bm{\psi}$
Adversarially

18: Sample $\\{\mathbf{x}_{m}\\}_{m=1}^{M}\sim P_{\mathsf{D}}(\mathbf{X})$

19: Compute $\mathbf{z}_{m}^{\mathsf{enc}}\\!$ from
$\\!f_{\\!\bm{\phi}}(\mathbf{x}_{m})\\!$ with reparametrization, $\forall
m\\!\in\\![M]$

20: Sample $\\{\mathbf{n}_{m}\\}_{m=1}^{M}\sim\mathcal{N}(\bm{0},\mathbf{I})$

21: Compute $\mathbf{z}_{m}^{\mathsf{prior}}\\!\\!$ from
$\\!g_{\bm{\psi}}(\mathbf{n}_{m}\\!)\\!$ with reparametrization, $\\!\forall
m\\!\in\\![M]\\!$

22: Back-propagate loss:
$\;\;\;\mathcal{L}\left(\bm{\phi},\bm{\psi}\right)=\frac{\alpha}{M}\;\sum_{m=1}^{M}\log
D_{\bm{\eta}}(\mathbf{z}_{m}^{\mathsf{enc}})+\log\big{(}1-D_{\bm{\eta}}(\,\mathbf{z}_{m}^{\mathsf{prior}}\,)\big{)}$
(4) Train the Utility Output Space Discriminator $\bm{\omega}$

23: Sample $\\{\mathbf{x}_{m}\\}_{m=1}^{M}\sim P_{\mathsf{D}}(\mathbf{X})$

24: Sample
$\\{\mathbf{n}_{m}\\}_{m=1}^{M}\sim\mathcal{N}\\!\left(\bm{0},\mathbf{I}\right)$

25: Compute $\mathbf{z}_{m}^{\mathsf{prior}}\\!\\!$ from
$\\!g_{\bm{\psi}}(\mathbf{n}_{m}\\!)\\!$ with reparametrization, $\\!\forall
m\\!\in\\![M]\\!$

26: Compute
$\mathbf{\widehat{x}}_{m}=g_{\bm{\theta}}(\mathbf{z}_{m}^{\mathsf{prior}}),\forall
m\in[M]$

27: Back-propagate loss:
$\mathcal{L}\left(\bm{\omega}\right)=-\frac{1}{M}\sum_{m=1}^{M}\log
D_{\bm{\omega}}(\mathbf{x}_{m})+\log\left(1-D_{\bm{\omega}}(\,\mathbf{\widehat{x}}_{m}\,)\right)$
(5) Train the Prior Distribution Generator $\bm{\psi}$, Utility Decoder
$\bm{\theta}$, and Uncertainty Decoder $\bm{\varphi}$ Adversarially

28: Sample
$\\{\mathbf{n}_{m}\\}_{m=1}^{M}\sim\mathcal{N}\\!\left(\bm{0},\mathbf{I}\right)$

29: Compute $\mathbf{z}_{m}^{\mathsf{prior}}\\!\\!$ from
$\\!g_{\bm{\psi}}(\mathbf{n}_{m}\\!)\\!$ with reparametrization, $\\!\forall
m\\!\in\\![M]\\!$

30: Compute $\mathbf{\widehat{x}}_{m}\sim
g_{\bm{\theta}}\left(\mathbf{z}_{m}^{\mathsf{prior}}\right),\forall m\in[M]$

31: Compute $\mathbf{\widetilde{x}}_{m}\sim
g_{\bm{\varphi}}\left(\mathbf{z}_{m}^{\mathsf{prior}},\mathbf{s}_{m}\right),\forall
m\in[M]$

32: Back-propagate loss:
$\;\;\;\;\mathcal{L}\left(\bm{\psi},\bm{\theta},\bm{\varphi}\right)\\!=\\!\frac{1}{M}\\!\\!\sum_{m=1}^{M}\\!\\!\log\left(1\\!-\\!D_{\bm{\omega}}(\,\mathbf{\widehat{x}}_{m}\,)\right)+\log\left(1\\!-\\!D_{\bm{\omega}}(\,\mathbf{\widetilde{x}}_{m}\,)\right)\\!\\!\\!\\!$
(6) Train Uncertainty Output Space Discriminator $\bm{\omega}$

33: Sample a mini-batch $\\{\mathbf{s}_{m},\mathbf{x}_{m}\\}_{m=1}^{M}\sim
P_{\mathsf{D}}(\mathbf{X})P_{\mathbf{S}\mid\mathbf{X}}$

34: Sample $\\{\mathbf{n}_{m}\\}_{m=1}^{M}\sim\mathcal{N}(\bm{0},\mathbf{I})$

35: Compute $\mathbf{z}_{m}^{\mathsf{prior}}\\!\\!$ from
$\\!g_{\bm{\psi}}(\mathbf{n}_{m}\\!)\\!$ with reparametrization, $\\!\forall
m\\!\in\\![M]\\!$

36: Compute $\mathbf{\widetilde{x}}_{m}\sim
g_{\bm{\varphi}}\left(\mathbf{z}_{m}^{\mathsf{prior}},\mathbf{s}_{m}\right),\forall
m\in[M]$

37: Back-propagate loss:
$\mathcal{L}\left(\bm{\omega}\right)=\frac{1}{M}\sum_{m=1}^{M}\log
D_{\bm{\omega}}(\,\mathbf{x}_{m}\,)+\log\left(1-D_{\bm{\omega}}(\,\mathbf{\widetilde{x}}_{m}\,)\right)$

38:until Convergence

39:return $\bm{\phi},\bm{\theta},\bm{\psi},\bm{\varphi},\bm{\eta},\bm{\omega}$

Algorithm 2 Deep Variational $\mathsf{GenPF}$ training algorithm associated
with $\mathsf{GenPF\text{-}MI}\;(\textsf{P2})$

###  5.5 Role of Information Complexity in Privacy Leakage

The implicit assumption in the PF model is to have pre-defined interests in
the game between the ‘defender’ (data owner/user) and the ‘adversary’; that
is, the data owner knows in advance what feature/variable of the underlying
data the adversary is interested in. Accordingly, the data release mechanism
can be optimized/tuned to minimize any inference the adversary can make about
this specific random variable. However, this assumption may be violated in
most real-world scenarios. The attribute that the defender may assume as
sensitive may not be the attribute of interest for the inferential adversary.
As an example, for a given utility task at hand, the defender may try to
restrict inference on gender recognition while the adversary is interested in
inferring an individual’s identity or facial emotion. Inspired by (Issa et
al., 2019), and in contrast to the above setups, we consider the scenario in
which the adversary is curious about an attribute that is unknown to the
system designer. In (Atashin et al., 2021), we assumed the adversary is
interested in an attribute $\mathbf{S}$ of data $\mathbf{X}$ which is not
known a priori to the defender777In other words, the distribution
$P_{\mathbf{S}\mid\mathbf{X}}$ is unknown to the defender.. Next, we argued
that the information complexity of the representation measured by mutual
information $\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)$ can also limit the
information leakage about the unknown sensitive variable.

##  6 Face Recognition Experiments

Face recognition systems represent a crucial segment within the larger domain
of biometric technology. They operate by identifying or verifying a person’s
identity through the analysis of facial features in digital images or video
frames. The technology employs complex algorithms and machine learning models
to compare specific facial attributes in an input image with those in a known
database, thereby establishing an individual’s identity or lack thereof. Face
recognition systems find widespread applications, ranging from security and
surveillance to social media and smartphone technology.

###  6.1 Face Recognition Leading Models and Their Core Mechanisms

The evolution of face recognition technology has been significantly influenced
by the development of several groundbreaking models, each distinguished by its
unique features and mechanisms. Prominent among these are DeepFace (Taigman et
al., 2014), FaceNet (Schroff et al., 2015), OpenFace (Amos et al., 2016),
SphereFace (Liu et al., 2017), CosFace (Wang et al., 2018), ArcFace (Deng et
al., 2019a), and AdaFace (Kim et al., 2022). These models have advanced the
field through their innovative use of deep learning techniques, setting new
standards in accuracy and reliability for face recognition tasks.

DeepFace, developed by Facebook, employs a deep neural network with over 120
million parameters, demonstrating notable robustness against pose variations
through advanced 3D modeling techniques. FaceNet, from Google, uses a ‘triplet
loss’ function to optimize distances between anchor, positive, and negative
images. Despite its effectiveness, FaceNet faces challenges related to the
large number of triplets in extensive datasets and complexities in mining
semi-hard samples. OpenFace, a Carnegie Mellon University innovation, offers a
lightweight yet efficient alternative, focusing on ‘TripletHardLoss’ for
challenging sample selection during training. This model excels in
environments with limited computational resources. Subsequent to OpenFace,
SphereFace introduced an angular margin penalty in its loss function to
enhance intra-class compactness and inter-class separation. SphereFace,
however, encountered training stability challenges due to the need for
computational approximations in its loss function. Building on these
advancements, CosFace added a cosine margin penalty directly to the target
logit, simplifying the implementation and improving performance without
requiring joint supervision from the softmax loss. This marked a significant
step forward in the development of margin-based loss functions. ArcFace, from
InsightFace, further refined the approach by introducing an ’Additive Angular
Margin Loss’, which optimizes the geodesic distance margin on a normalized
hypersphere. Known for its ease of implementation and computational
efficiency, ArcFace achieved state-of-the-art performance across various
benchmarks. Most recently, AdaFace has represented a significant leap in
addressing image quality variations in face recognition. By correlating
feature norms with image quality, AdaFace adapts its margin function to
emphasize hard samples in high-quality images and de-emphasize them in lower-
quality ones. This adaptive approach, blending angular and additive margins
based on image quality, represents a notable advancement in the field.

###  6.2 Backbone Architectures for Feature Extraction

In the context of face recognition systems, backbone architectures provide the
core structure essential for extracting and learning high-level features from
raw input data. These architectures, underpinning the design of face
recognition models, significantly influence their capacity to discern facial
features and, consequently, their performance. One of the key architectures in
this domain is the Improved ResNet, or iResNet (Duta et al., 2021). As an
advanced iteration of the ResNet (He et al., 2016) model, iResNet integrates
modifications that aim to resolve issues related to the degradation of deeper
networks. It is characterized by its residual learning framework, which
effectively tackles the vanishing gradient problem, a common challenge with
deep neural networks. This allows for the training of networks with increased
depth, thereby facilitating a more profound extraction of facial features. The
modularity of iResNet, which can be adapted to various depths, provides the
flexibility to balance computational efficiency and model accuracy based on
the specific requirements of a given task. This adaptability extends the use
of iResNet across different face recognition models, each leveraging the
architecture’s strengths according to their individual design principles.
Other backbone architectures, such as VGGNet (Simonyan and Zisserman, 2014)
and MobileNet (Howard et al., 2017), are also employed in the design of face
recognition models. VGGNet, with its homogeneously stacked convolutional
layers, excels in extracting features from input images of varying complexity.
On the other hand, MobileNet, with its depthwise separable convolutions,
offers an efficient, lightweight solution optimal for mobile and edge
computing applications. The choice of backbone architecture significantly
influences the face recognition model’s performance, shaping its ability to
extract necessary features, adapt to varying task complexities, and function
efficiently within the given computational constraints. As such, selecting the
most suitable architecture is crucial for the successful deployment of a face
recognition system.

###  6.3 Datasets for Training and Validation

The viability and robustness of face recognition systems hinge significantly
on the quality and diversity of the datasets used for their training and
validation. These datasets supply a spectrum of facial data crucial for model
training, acting as the cornerstone upon which these systems develop their
ability to recognize and differentiate facial features.

The MSCeleb1M dataset (Deng et al., 2019b) is a noteworthy resource in this
domain, providing a comprehensive collection of over a million celebrity
images. Its richness in terms of varied expressions, poses, illumination
conditions, and occlusions makes it invaluable for model training, enhancing
the system’s capacity to handle real-world variability.

The WebFace dataset (Zhu et al., 2021), officially known as CASIA-WebFace,
provides a large-scale face dataset for training deep models. With nearly half
a million images from over 10,000 individuals, it offers a diverse range of
facial images sourced from the internet. This dataset has become a staple in
the face recognition community for developing and benchmarking algorithms,
particularly because of its real-world diversity and the challenges it
presents in terms of data variability.

The MORPH dataset (Ricanek and Tesafaye, 2006) distinguishes itself with its
focus on longitudinal facial data, charting the progression of facial features
over time. The inclusion of aging-related variations makes this dataset
crucial for the development of age-invariant face recognition capabilities, an
essential attribute for models deployed in dynamic, real-world scenarios.

The FairFace dataset (Karkkainen and Joo, 2021) is an intervention in the
realm of equitable face recognition. Designed to mitigate racial and
demographic biases, it includes a balanced representation of seven racial
groups and a diverse distribution of age and gender within each group. With
approximately 100,000 (exactly 108,501) images, FairFace is a valuable
resource for training and evaluating face recognition systems, ensuring they
perform fairly across different demographics. This dataset is particularly
crucial for developing models that can operate justly in multicultural
societies, where fairness and inclusivity are paramount.

For unconstrained face recognition, the Labeled Faces in the Wild (LFW) (Huang
et al., 2008) and the IARPA Janus Benchmark-C (IJBC) (Maze et al., 2018)
datasets have made significant contributions. The LFW dataset comprises images
collected from the internet, encapsulating the real-world conditions a face
recognition system is likely to encounter, including variability in pose,
lighting, and expression. IJBC, on the other hand, provides a challenging,
large-scale evaluation of face recognition technology under uncontrolled
conditions. It includes several variations such as pose, illumination,
expression, race, and age, thereby pushing the boundaries of model
performance.

###  6.4 Metrics Used to Evaluate Face Recognition Model Performance

In this subsection, we will elucidate the key metrics utilized to assess the
performance of face recognition models in our experiments. This elucidation
may prove particularly helpful to readers who lack prior familiarity with the
components of biometric systems or the interpretation of fundamental
information-theoretic measures. Readers with existing knowledge in these areas
may choose to bypass this introductory material.

####  6.4.1 False Match Rate ($\mathsf{FMR}$)

The False Match Rate ($\mathsf{FMR}$), also known as the False Acceptance Rate
($\mathsf{FAR}$), quantifies the rate at which the system erroneously accepts
an imposter’s face as a genuine match. In other words, it measures the
probability of a false positive identification. $\mathsf{FMR}$ is calculated
by dividing the number of falsely accepted imposter faces by the total number
of verification attempts on imposter faces.

$\mathsf{FMR}=\frac{\mathsf{Number~{}of~{}False~{}Acceptances}}{\mathsf{Total~{}Imposter~{}Verification~{}Attempts}}.$
(36)

Lower $\mathsf{FMR}$ values indicate a higher level of security and a reduced
likelihood of unauthorized access. The choice of an appropriate threshold for
$\mathsf{FMR}$ is essential and often depends on the specific application and
security requirements. A lower threshold increases security but may lead to
higher False Rejection Rates ($\mathsf{FRR}$), which can inconvenience
legitimate users.

####  6.4.2 True Match Rate ($\mathsf{TMR}$)

The True Match Rate ($\mathsf{TMR}$), also known as the True Acceptance Rate
(TAR), measures the system’s ability to correctly identify or verify genuine
matches. It quantifies the probability of a true positive identification,
where the system correctly accepts a genuine user. $\mathsf{TMR}$ is
calculated by dividing the number of correctly accepted genuine matches by the
total number of verification attempts on genuine faces.

$\mathsf{TMR}=\frac{\mathsf{Number~{}of~{}True~{}Acceptances}}{\mathsf{Total~{}Genuine~{}Verification~{}Attempts}}.$
(37)

Higher $\mathsf{TMR}$ values signify a higher level of accuracy in correctly
accepting genuine users, which is desirable in most face recognition
applications. However, a high $\mathsf{TMR}$ may be accompanied by an
increased risk of false positives (higher $\mathsf{FMR}$) if the threshold is
set too low. Balancing $\mathsf{TMR}$ and $\mathsf{FMR}$ is crucial to achieve
the desired level of security and convenience in the application.

####  6.4.3 Accuracy ($\mathsf{Acc}$)

Accuracy is a fundamental metric that provides a holistic view of a face
recognition system’s performance. It encompasses both the $\mathsf{TMR}$ and
the $\mathsf{FMR}$ by considering the correct and incorrect identifications
collectively. Accuracy is calculated by dividing the total number of correct
verifications (true positives and true negatives) by the total number of
verification attempts (all cases).

$\mathsf{Acc}=\frac{\mathsf{Number~{}of~{}True~{}Positives}+\mathsf{Number~{}of~{}True~{}Negatives}}{\mathsf{Total~{}Verification~{}Attempts}}.$
(38)

High accuracy values indicate a robust system with a low rate of both false
positives and false negatives. Achieving a high accuracy rate is typically the
primary objective in face recognition applications, as it ensures that the
system correctly identifies genuine users while minimizing the likelihood of
unauthorized access.

####  6.4.4 Shannon Entropy

Entropy is a measure of the randomness or uncertainty of a variable. For a
discrete variable $\mathbf{S}$ with a probability mass function
$P_{\mathbf{S}}$, the Shannon entropy is defined as
$\mathrm{H}(\mathbf{S})=-\sum P_{\mathbf{S}}\log(P_{\mathbf{S}})$. Entropy
enables us to assess the degree of uncertainty within our (sensitive) labels
$\mathbf{S}$. The maximum possible entropy of a discrete random variable is
$\log\left(|\mathcal{S}|\right)$, where $|\mathcal{S}|$ represents the
cardinality of the variable. For example, if $\mathbf{S}$ represents gender
(with two categories), the maximum entropy is $\log_{2}(2)=1$, while for race
(e.g. with four categories), the maximum entropy is $\log_{2}(4)=2$. When our
calculated entropy is less than the maximum value of
$\log\left(|\mathcal{S}|\right)$, it indicates an imbalance in the
distribution of our labels. In other words, the labels are not uniformly
distributed, and there is some degree of predictability or bias in the
variable.

####  6.4.5 Mutual Information

Mutual information quantifies the extent to which knowledge of one variable
reduces uncertainty about another. It is defined as
$\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)=\mathrm{H}\left(\mathbf{S}\right)-\mathrm{H}\left(\mathbf{S}\mid|\mathbf{Z}\right)$.
This formula measures the reduction in uncertainty about the (sensitive)
labels ($\mathbf{S}$) when we possess knowledge of the embeddings
($\mathbf{Z}$). The close proximity of the values of
$\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)$ to $\mathrm{H}(\mathbf{S})$
indicates that knowing the embeddings $\mathbf{Z}$ significantly reduces
uncertainty about the labels $\mathbf{S}$. Mutual information is a symmetric
measure
($\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)=\mathrm{I}\left(\mathbf{Z};\mathbf{S}\right)$).
Additionally, it can be expressed as
$\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)=\mathrm{H}(\mathbf{S})+\mathrm{H}(\mathbf{Z})-\mathrm{H}(\mathbf{S},\mathbf{Z})$,
where $\mathrm{H}(\mathbf{S},\mathbf{Z})$ represents the joint entropy of both
$\mathbf{S}$ and $\mathbf{Z}$. This equation reveals that mutual information
also quantifies the reduction in joint uncertainty regarding both $\mathbf{S}$
and $\mathbf{Z}$ when we have information about either variable. It is
essential to emphasize that
$\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)\leq\min\left(\mathrm{H}(\mathbf{S}),\mathrm{H}(\mathbf{Z})\right)$.
This inequality stems from the fact that information shared between
$\mathbf{S}$ and $\mathbf{Z}$ cannot exceed the initial uncertainty present in
either $\mathbf{S}$ or $\mathbf{Z}$. In simpler terms, mutual information
cannot exceed the total information content in either $\mathbf{S}$ or
$\mathbf{Z}$.

###  6.5 Experiments Setup

We consider the state-of-the-art Face Recognition (FR) backbones with three
variants of iResNet (He et al., 2016; Deng et al., 2019a) architecture
(iResNet100, iResNet50, and iResNet18). These architectures have been trained
using either the MS1MV3 (Deng et al., 2019b) or WebFace4M/12M (Zhu et al.,
2021) datasets. For loss functions, ArcFace (Deng et al., 2019a) and AdaFace
(Kim et al., 2022) methods were employed. For the training phase, we utilized
pre-trained models sourced from the aforementioned studies. All input images
underwent a standardized pre-processing routine, encompassing alignment,
scaling, and normalization. This was in accordance with the specifications of
the pre-trained models. We then trained our networks using the Morph dataset
(Ricanek and Tesafaye, 2006) and FairFace (Karkkainen and Joo, 2021), focusing
on different demographic group combinations such as race and gender. Figure 7
depicts our framework during the training phase for a specific setup, which we
will explain later. Figure 8 shows the trained modules. Figure 9 illustrates
our framework during the inference phase. We will provide more details in Sec.
6.6.

####  6.5.1 Learning Scenarios

We consider two types of data available for $\mathbf{X}$: (i) raw image
samples, and (ii) feature extractions, commonly referred to as embeddings,
from the facial images. In the case of raw images, we have the option to
employ one of two distinct encoder types: (i) a custom encoder, which will be
trained from scratch, or (ii) a backbone encoder that leverages a pre-trained
network and undergoes further refinement via fine-tuning during the training
process. Alternatively, when working with facial image embeddings, we utilize
a custom multi-layer perceptron (MLP) encoder, which is also intended to be
trained from scratch. Based on the utility and uncertainty decoder objectives,
we identify two types of decoder tasks: (i) reconstruction, and (ii)
classification tasks. Taking these setups into account, we investigate three
learning scenarios as follows:

End-to-End Raw Data Scratch Learning: In this approach, our objective is to
train a custom encoder model (alongside other networks) from scratch, using
raw data samples as input. The model learns data representations directly from
the raw input without relying on prior knowledge from a pre-trained model.
This method is suitable when the dataset is sufficiently large and diverse to
support training a deep neural network from scratch and when the aim is to
learn data representations directly from the raw input.

Raw Data Transfer Learning with Fine-Tuning: In this approach, a pre-trained
(base) model is employed to enhance the performance of a model on a
potentially smaller or more specialized dataset. The pre-trained model serves
as the backbone, with a mid-layer selected as the latent representation. This
method is suitable when the dataset is small and specialized, and fine-tuning
the pre-trained model can offer significant improvement over training a model
from scratch.

Embedding-Based Data Learning: In this approach, our goal is to employ a
multi-layer perceptron (MLP) projector network as our encoder model, which
uses extracted features (embeddings) as input. This method is suitable when a
fine-tuned face recognition model has already learned meaningful (useful)
features from a large and diverse dataset. Utilizing these features as input
to a machine learning model can potentially offer an improvement over training
a model from scratch or fine-tuning a pre-trained model. This approach
leverages the pre-trained model’s ability to capture relevant information and
may reduce the computational cost and complexity associated with end-to-end
learning from raw data. Figure 7 depicts an example of our training framework
for this setup.

Figure 7: Training the deep variational $\mathsf{DisPF}$ model for face
recognition experiments, employing the learning scenario ‘Embedding-Based Data
Learning’.

(a)

(b)

Figure 8: The $\mathsf{DisPF}$ and $\mathsf{GenPF}$ modules have been trained
and are designed for integration in a plug-and-play manner. These modules are
characterized by a set of specific parameters: ‘dataset name’ (for example,
FairFace), which denotes the dataset utilized; ‘sensitive attribute name’
(e.g., Race); ‘alpha’ (e.g., 0.1); ‘latent $\mathbf{Z}$ dimension’ (e.g.,
128); ‘backbone’ (e.g., iResNet 50); ‘loss function’ (e.g., arcface); and
‘backbone trained dataset’ (e.g., WebFace12M). Table 1: Evaluation of facial
recognition models using various backbones and loss functions. Metrics include
entropy, mutual information between embeddings and labels (gender and race),
and recognition accuracy on the ‘Morph’ and ‘FairFace’ datasets.

|  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
| $\mathrm{H}(\mathbf{S})$ | $\mathrm{I}(\mathbf{X};\mathbf{S})$ | Acc | $\mathrm{H}(\mathbf{S})$ | $\mathrm{I}(\mathbf{X};\mathbf{S})$ | Acc
| Backbone Dataset
---
Backbone | Loss Function | Applied Dataset | Train | Test | Train | Test | Train | Test | Train | Test | Train | Test | Train | Test
WebFace4M | iResNet18 | AdaFace | Morph | 0.619 | 0.621 | 0.610 | 0.620 | 0.999 | 0.996 | 0.924 | 0.933 | 0.878 | 0.924 | 0.998 | 0.993
WebFace4M | iResNet50 | AdaFace | Morph | 0.610 | 0.620 | 0.999 | 0.996 | 0.873 | 0.930 | 0.998 | 0.992
WebFace12M | iResNet101 | AdaFace | Morph | 0.605 | 0.622 | 0.999 | 0.996 | 0.873 | 0.911 | 0.998 | 0.992
MS1M-RetinaFace | iResNet50 | ArcFace | Morph | 0.600 | 0.620 | 0.999 | 0.996 | 0.865 | 0.910 | 0.997 | 0.993
MS1M-RetinaFace | iResNet100 | ArcFace | Morph | 0.597 | 0.618 | 0.999 | 0.997 | 0.868 | 0.905 | 0.997 | 0.993
WebFace4M | iResNet18 | AdaFace | FairFace | 0.999 | 0.999 | 0.930 | 0.968 | 0.953 | 0.923 | 2.517 | 2.515 | 2.099 | 2.405 | 0.882 | 0.763
WebFace4M | iResNet50 | AdaFace | FairFace | 0.932 | 0.968 | 0.954 | 0.931 | 2.113 | 2.409 | 0.883 | 0.769
WebFace12M | iResNet101 | AdaFace | FairFace | 0.934 | 0.969 | 0.957 | 0.930 | 2.151 | 2.417 | 0.892 | 0.765
MS1M-RetinaFace | iResNet50 | ArcFace | FairFace | 0.892 | 0.962 | 0.950 | 0.927 | 1.952 | 2.355 | 0.872 | 0.753
MS1M-RetinaFace | iResNet100 | ArcFace | FairFace | 0.889 | 0.954 | 0.951 | 0.927 | 1.949 | 2.348 | 0.875 | 0.765

Figure 9: Evaluating the performance of the deep variational $\mathsf{DisPF}$
model, which was trained on the FairFace dataset, when applied to the IJBC
test dataset (cross-dataset evaluation). This evaluation highlights the use of
$\mathsf{DisPF}$ as a plug-and-play module within the information flow of
state-of-the-art face recognition models.

###  6.6 Experiments Results

####  6.6.1 Evaluation of Morph and FairFace Datasets Before Applying DVPF

Table 1 depicts the Shannon entropy, estimated mutual information between the
extracted embeddings $\mathbf{X}\in\mathbb{R}^{512}$ and sensitive attributes
$\mathbf{S}$, and accuracy of classification of $\mathbf{S}$, for test and
train sets, before applying our DVPF model. A close proximity between
$\mathrm{I}(\mathbf{X};\mathbf{S})$ and entropy $\mathrm{H}(\mathbf{S})$
indicates that the embeddings considerably mitigate label uncertainty. Given
$\mathrm{I}(\mathbf{X};\mathbf{S})=\mathrm{H}(\mathbf{X})+\mathrm{H}(\mathbf{S})-\mathrm{H}(\mathbf{X},\mathbf{S})$,
mutual information serves as a measure of the reduced joint uncertainty about
$\mathbf{X}$ and $\mathbf{S}$. It’s pivotal to note that
$\mathrm{I}(\mathbf{X};\mathbf{S})\leq\min\left(\mathrm{H}(\mathbf{X}),\mathrm{H}(\mathbf{S})\right)$.
For the Morph/FairFace datasets, the entropy of sensitive attributes (gender
or race) remains consistent across both train/test sets and differing FR model
embeddings, emphasizing the same dataset usage throughout experiments. Both
Morph and FairFace datasets, featuring ‘male’ and ‘female’ gender labels,
attain a maximum entropy of $\log_{2}(2)=1$. The Morph dataset, with four
distinct race labels, reaches a maximum entropy of $\log_{2}(4)=2$, while the
FairFace dataset, with six race labels, tops at $\log_{2}(6)=2.585$. Within
Morph, the mutual information for gender mirrors its entropy, suggesting
notable preservation of sensitive information in the embeddings. However, for
race, values of approximately $0.92\text{-}0.93$ underscore an imbalanced
label distribution, as they don’t reach the theoretical $\log_{2}(4)=2$. In
contrast, the FairFace dataset displays near-maximal entropies for race ($\sim
2.517$ relative to a potential $2.585$) and gender ($\sim 0.999$ compared to
an ideal $1$), illustrating well-balanced racial and gender label
distributions.

Table 2: Analysis of the obfuscation-utility trade-off in face recognition
models using the iResNet-50 architecture with (P1) and (P2). Performance is
evaluated across varying information leakage weights $\alpha$, with
significant differences between $\alpha=0.1$ and $\alpha=10$. Sensitive
attributes considered are ‘Gender’ and ‘Race’ with a latent dimensionality of
$d_{\mathbf{z}}=512$ (top), $d_{\mathbf{z}}=256$ (middle), and
$d_{\mathbf{z}}=128$ (down). Notations: “WF4M” represents “WebFace4M”,
“MS1M-RF” denotes “MS1M-RetinaFace”, and “TMR” represents “TMR@FMR=10e-1”.

(P1) |  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
($d_{\mathbf{z}}=512$) | $\alpha=0.1$ | $\alpha=1$ | $\alpha=10$ | $\alpha=0.1$ | $\alpha=1$ | $\alpha=10$
Face Recognition Model | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$
WF4M-i50-Ada-Morph | 87.31 | 0.486 | 0.985 | 67.55 | 0.484 | 0.946 | 34.42 | 0.410 | 0.847 | 87.13 | 0.658 | 0.997 | 63.51 | 0.656 | 0.997 | 32.58 | 0.558 | 0.997
MS1M-RF-i50-Arc-Morph | 95.60 | 0.473 | 0.991 | 83.42 | 0.468 | 0.970 | 60.49 | 0.416 | 0.846 | 95.64 | 0.573 | 0.997 | 83.34 | 0.566 | 0.997 | 60.10 | 0.554 | 0.997
WF4M-i50-Ada-FairFace | 84.00 | 0.736 | 0.916 | 65.66 | 0.650 | 0.807 | 42.97 | 0.524 | 0.582 | 84.30 | 1.306 | 0.942 | 65.51 | 1.129 | 0.893 | 43.18 | 0.858 | 0.756
MS1M-RF-i50-Arc-FairFace | 93.78 | 0.680 | 0.917 | 83.99 | 0.677 | 0.859 | 61.03 | 0.586 | 0.605 | 93.81 | 1.090 | 0.945 | 84.03 | 1.005 | 0.914 | 61.44 | 0.830 | 0.762

(P1) |  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
($d_{\mathbf{z}}=256$) | $\alpha=0.1$ | $\alpha=1$ | $\alpha=10$ | $\alpha=0.1$ | $\alpha=1$ | $\alpha=10$
Face Recognition Model | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$
WF4M-i50-Ada-Morph | 91.99 | 0.464 | 0.992 | 46.98 | 0.444 | 0.949 | 29.56 | 0.388 | 0.843 | 91.86 | 0.628 | 0.997 | 47.42 | 0.705 | 0.997 | 30.99 | 0.550 | 0.857
MS1M-RF-i50-Arc-Morph | 93.30 | 0.485 | 0.992 | 84.08 | 0.492 | 0.971 | 58.62 | 0.335 | 0.846 | 94.01 | 0.635 | 0.997 | 84.10 | 0.707 | 0.997 | 58.24 | 0.558 | 0.868
WF4M-i50-Ada-FairFace | 92.34 | 0.638 | 0.925 | 63.12 | 0.653 | 0.815 | 39.75 | 0.367 | 0.576 | 92.41 | 0.866 | 0.946 | 58.67 | 0.950 | 0.893 | 38.80 | 0.595 | 0.756
MS1M-RF-i50-Arc-FairFace | 90.87 | 0.636 | 0.915 | 82.01 | 0.652 | 0.860 | 59.62 | 0.388 | 0.598 | 90.86 | 0.899 | 0.947 | 81.98 | 0.873 | 0.919 | 60.33 | 0.608 | 0.766

(P1) |  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
($d_{\mathbf{z}}=128$) | $\alpha=0.1$ | $\alpha=1$ | $\alpha=10$ | $\alpha=0.1$ | $\alpha=1$ | $\alpha=10$
Face Recognition Model | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$
WF4M-i50-Ada-Morph | 88.20 | 0.392 | 0.988 | 67.55 | 0.387 | 0.952 | 21.76 | 0.205 | 0.845 | 87.70 | 0.563 | 0.998 | 67.50 | 0.632 | 0.997 | 20.85 | 0.375 | 0.997
MS1M-RF-i50-Arc-Morph | 97.60 | 0.358 | 0.988 | 85.91 | 0.320 | 0.974 | 62.97 | 0.278 | 0.848 | 97.61 | 0.574 | 0.998 | 86.01 | 0.603 | 0.997 | 62.41 | 0.421 | 0.996
WF4M-i50-Ada-FairFace | 94.38 | 0.437 | 0.892 | 68.70 | 0.420 | 0.809 | 21.47 | 0.198 | 0.546 | 94.49 | 0.716 | 0.937 | 68.49 | 0.665 | 0.892 | 21.36 | 0.291 | 0.733
MS1M-RF-i50-Arc-FairFace | 98.03 | 0.425 | 0.890 | 86.07 | 0.412 | 0.860 | 61.11 | 0.284 | 0.637 | 97.77 | 0.631 | 0.933 | 86.07 | 0.657 | 0.919 | 61.25 | 0.551 | 0.783

(P2) |  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
($d_{\mathbf{z}}=512$) | $\alpha=0.1$ | $\alpha=0.5$ | $\alpha=1$ | $\alpha=10$ | $\alpha=0.1$ | $\alpha=0.5$ | $\alpha=1$ | $\alpha=10$
Face Recognition Model | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$
WF4M-i50-Ada-Morph | 81.68 | 0.559 | 0.986 | 60.90 | 0.570 | 0.966 | 51.86 | 0.564 | 0.945 | 38.20 | 0.529 | 0.853 | 82.22 | 0.788 | 0.998 | 61.07 | 0.803 | 0.997 | 52.18 | 0.791 | 0.997 | 36.26 | 0.737 | 0.996
MS1M-RF-i50-Arc-Morph | 91.18 | 0.552 | 0.991 | 77.86 | 0.572 | 0.978 | 73.82 | 0.562 | 0.962 | 67.40 | 0.524 | 0.876 | 91.37 | 0.765 | 0.998 | 77.76 | 0.796 | 0.977 | 73.56 | 0.794 | 0.997 | 67.82 | 0.751 | 0.996
WF4M-i50-Ada-FairFace | 85.56 | 0.850 | 0.918 | 63.75 | 0.868 | 0.885 | 54.94 | 0.859 | 0.853 | 40.42 | 0.809 | 0.759 | 85.43 | 1.719 | 0.944 | 63.89 | 1.810 | 0.926 | 54.38 | 1.794 | 0.908 | 39.47 | 1.699 | 0.839
MS1M-RF-i50-Arc-FairFace | 92.20 | 0.819 | 0.914 | 78.34 | 0.869 | 0.891 | 74.08 | 0.863 | 0.868 | 68.00 | 0.827 | 0.795 | 92.15 | 1.547 | 0.944 | 78.26 | 1.796 | 0.932 | 73.36 | 1.745 | 0.920 | 67.65 | 1.708 | 0.872

(P2) |  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
($d_{\mathbf{z}}=256$) | $\alpha=0.1$ | $\alpha=0.5$ | $\alpha=1$ | $\alpha=10$ | $\alpha=0.1$ | $\alpha=0.5$ | $\alpha=1$ | $\alpha=10$
Face Recognition Model | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$
WF4M-i50-Ada-Morph | 81.88 | 0.585 | 0.987 | 60.65 | 0.586 | 0.971 | 50.92 | 0.569 | 0.953 | 37.57 | 0.539 | 0.873 | 81.90 | 0.773 | 0.998 | 60.66 | 0.812 | 0.997 | 51.51 | 0.816 | 0.997 | 38.08 | 0.765 | 0.996
MS1M-RF-i50-Arc-Morph | 91.58 | 0.539 | 0.991 | 77.60 | 0.575 | 0.981 | 72.96 | 0.580 | 0.968 | 67.06 | 0.549 | 0.899 | 91.74 | 0.792 | 0.998 | 77.59 | 0.812 | 0.997 | 73.03 | 0.812 | 0.997 | 67.31 | 0.776 | 0.996
WF4M-i50-Ada-FairFace | 86.67 | 0.844 | 0.916 | 63.64 | 0.865 | 0.892 | 54.41 | 0.830 | 0.865 | 40.61 | 0.771 | 0.762 | 86.61 | 1.611 | 0.944 | 63.62 | 1.699 | 0.930 | 54.43 | 1.653 | 0.916 | 39.75 | 1.503 | 0.855
MS1M-RF-i50-Arc-FairFace | 92.34 | 0.845 | 0.915 | 77.51 | 0.863 | 0.901 | 73.00 | 0.853 | 0.882 | 67.51 | 0.779 | 0.803 | 92.35 | 1.528 | 0.943 | 77.48 | 1.701 | 0.936 | 72.76 | 1.678 | 0.926 | 66.90 | 1.571 | 0.882

(P2) |  $\mathbf{S}$: Gender |  $\mathbf{S}$: Race
---|---|---
($d_{\mathbf{z}}=128$) | $\alpha=0.1$ | $\alpha=0.5$ | $\alpha=1$ | $\alpha=10$ | $\alpha=0.1$ | $\alpha=0.5$ | $\alpha=1$ | $\alpha=10$
Face Recognition Model | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$ | TMR | $\mathrm{I}(\mathbf{Z};\mathbf{S})$ | Acc on $\mathbf{S}$
WF4M-i50-Ada-Morph | 84.06 | 0.556 | 0.984 | 62.62 | 0.575 | 0.973 | 52.05 | 0.572 | 0.963 | 36.76 | 0.531 | 0.906 | 84.14 | 0.810 | 0.998 | 62.94 | 0.827 | 0.997 | 52.34 | 0.820 | 0.997 | 36.26 | 0.789 | 0.996
MS1M-RF-i50-Arc-Morph | 93.00 | 0.541 | 0.987 | 79.40 | 0.573 | 0.981 | 73.50 | 0.572 | 0.974 | 66.28 | 0.535 | 0.927 | 93.10 | 0.800 | 0.998 | 79.99 | 0.828 | 0.997 | 74.04 | 0.825 | 0.997 | 65.94 | 0.793 | 0.996
WF4M-i50-Ada-FairFace | 88.51 | 0.724 | 0.893 | 67.43 | 0.738 | 0.870 | 57.44 | 0.729 | 0.854 | 39.27 | 0.676 | 0.800 | 88.55 | 1.375 | 0.938 | 67.34 | 1.503 | 0.926 | 57.28 | 1.479 | 0.916 | 39.60 | 1.359 | 0.877
MS1M-RF-i50-Arc-FairFace | 94.14 | 0.700 | 0.890 | 81.81 | 0.749 | 0.878 | 75.95 | 0.743 | 0.869 | 67.16 | 0.719 | 0.836 | 94.23 | 1.136 | 0.934 | 81.67 | 1.381 | 0.927 | 75.96 | 1.404 | 0.922 | 67.16 | 1.368 | 0.903

(a)

(b)

(c)

(d)

Figure 10: Trade-off between information utility and privacy leakage using
DVPF models for gender attribute: comparing classification accuracy on
FairFace and TMR on IJB-C.

####  6.6.2 Evaluation of Morph and FairFace Datasets After Applying DVPF

We applied our deep variational $\mathsf{DisPF}$ (21) and $\mathsf{GenPF}$
(22) models to the embeddings obtained from the FR models referenced in Table
1. The assessment was initiated with the pre-trained backbones, followed by
our $\mathsf{DisPF}$ or $\mathsf{GenPF}$ model, which was developed using
embeddings from these pre-trained structures. Figure 7 represents our training
framework for the deep $\mathsf{DisPF}$ problem, using iResNet50 as the
backbone, WebFace4M as the backbone dataset, and ArcFace for the FR loss. The
applied dataset is FairFace, with race as the sensitive attribute. We
considered a similar embedding-based learning framework for the deep
$\mathsf{GenPF}$ problem. Given the consistent accuracy for sensitive
attribute $\mathbf{S}$ and similar information leakage
$\mathrm{I}\left(\mathbf{X};\mathbf{S}\right)$ observed across various iResNet
architectures, we present results specific to iResNet50. Figure 8 depicts the
trained modules that we will use during the inference phase for both same-
dataset evaluations (where the models are tested on unseen portions of the
dataset they were trained on) and cross-dataset evaluations (where the models
are tested on entirely different datasets to assess their ability to
generalize to new data)

In Table 2, we precisely quantify the disclosed information leakage,
represented as $\mathrm{I}(\mathbf{S};\mathbf{Z})$. Additionally, we provide a
detailed account of the accuracy achieved in recognizing sensitive attributes
from the disclosed representation $\mathbf{Z}\in\mathbb{R}^{256}$, utilizing a
support vector classifier optimization. These evaluations are based on test
sets derived from either the Morph or FairFace datasets. Consistent with our
expectations, as $\alpha$ increases towards infinity
($\alpha\rightarrow\infty$), the information leakage
$\mathrm{I}(\mathbf{S};\mathbf{Z})$ decreases to zero. At the same time, the
recognition accuracy for the sensitive attribute $\mathbf{S}$ approaches
$0.5$, indicative of random guessing.

(a)

(b)

(c)

(d)

Figure 11: Trade-off between information utility and privacy leakage using
DVPF models for race attribute: comparing classification accuracy on FairFace
and TMR on IJB-C.

####  6.6.3 TMR Benchmark on IJB-C in FairFace Experiments

To evaluate the generalization of our mechanisms in terms of FR accuracy, we
utilized the challenging IJB-C test dataset (Maze et al., 2018) as a
challenging benchmark. Figure 9 depicts our inference framework, which
incorporates the $\mathsf{DisPF}$ trained module. We employ a similar
inference framework for the $\mathsf{GenPF}$ trained module. We detail the
$\mathsf{TMR}$ of our models in Table 2. It’s imperative to note that all
these evaluations are systematically benchmarked against a predetermined False
Match Rate ($\mathsf{FMR}$) of $10^{-1}$.When subjecting the ‘WF4M-i50-Ada’
model to evaluation against the IJB-C dataset—prior to the DVPF model’s
integration—a $\mathsf{TMR}$ of $\mathsf{99.40\%}$ at $\mathsf{FMR=10e-1}$ was
observed. Similarly, for the ‘MS1M-RF-i50-Arc’ configuration, a $\mathsf{TMR}$
of $\mathsf{99.58\%}$ was observed on the IJB-C dataset before the integration
of the DVPF model, with measurements anchored to the same $\mathsf{FMR}$. In
Figure 10 and Figure 11, we demonstrate the interplay between information
utility and privacy leakage across varying information leakage weights
$\alpha$. The right y-axis quantifies the classification accuracy of the
sensitive attribute $\mathbf{S}$, as evaluated on the FairFace dataset. In
contrast, the left y-axis depicts the $\mathsf{TMR}$ on the IJB-C test
dataset. This measurement is derived from the performance of trained Deep
Variational Privacy Filtering (DVPF) models $(\textsf{P1})$ and
$(\textsf{P2})$, initially trained on the FairFace dataset and subsequently
tested on the IJB-C dataset.

Figure 10 focuses on the results obtained using the WF4M-i50-Ada-FairFace
configuration (where ‘Backbone Dataset’ is WebFace4M, ‘Backbone Architecture’
is iResNet50, ‘Loss Function’ is AdaFace, and ‘Applied Dataset’ for training
is FairFace, ‘Dataset for Testing Utility’ ($\mathsf{TMR}$) being IJB-C) and
MS1M-RF-i50-Arc-FairFace configuration (with ‘Backbone Dataset’ as
MS1M-RetinaFace, ‘Backbone Architecture’ as iResNet50, ‘Loss Function’ as
ArcFace, and ‘Applied Dataset’ for training as FairFace; ‘Dataset for Testing
Utility’ ($\mathsf{TMR}$) being IJB-C) when the sensitive attribute under
consideration for training is gender. Figure 11 presents analogous results,
but for cases where the sensitive attribute for training is race.

####  6.6.4 Visualizing DVPF Effects on FairFace and IJB-C Data with t-SNE

Figure 12 and Figure 13 provide qualitative visualization of the leakage in
sensitive attribute classification on the FairFace database, both before and
after applying the DVPF model with $\mathbf{S}$ set as race or gender,
respectively. For this, we use t-distributed stochastic neighbor embedding
(t-SNE) (Maaten and Hinton, 2008) to project the underlying space into 2D. As
illustrated, distinct regions associated with six racial classes (Asian,
Black, Hispanic, Indian, Middle-Eastern, White) are evident in the clean
embedding. However, after applying the DVPF (P1) mechanism with $\alpha=10$,
the sensitive labels become almost uniformly distributed across the space.
This distribution aligns with our interpretation of random guessing
performance on the adversary’s side. This behavior is consistent for both
ArcFace and AdaFace protected embeddings, and for both gender and race as
sensitive attributes. However, for brevity, we present only one example.
Figure 14 depicts the normalized confusion matrices for the FairFace dataset,
obtained after applying the DVPF (P1) mechanism. In these matrices,
$\mathbf{S}$ is considered as race, and the configuration is MS1M-RF-i50-Arc-
FairFace, with $\alpha$ values set at $0.1$ and $10$. Notably, as $\alpha$
increases, the diagonal dominance in the matrices becomes less pronounced,
indicating a higher probability of misclassification of the sensitive
attribute.

(a)

(b)

(c)

(d)

Figure 12: t-SNE visualizations of the FairFace dataset with $\mathbf{S}$
representing ‘race’, using the (P2) model, setting $\alpha=10$ and
$d_{\mathbf{z}}=128$. The visualizations include: (a) AdaFace original (clean)
embeddings, (b) Post-DVPF AdaFace embeddings, (c) ArcFace original (clean)
embeddings, and (d) Post-DVPF ArcFace embeddings.

(a)

(b)

(c)

(d)

Figure 13: t-SNE visualizations of the FairFace dataset with $\mathbf{S}$
representing ‘gender’, using the (P2) model, setting $\alpha=10$ and
$d_{\mathbf{z}}=128$. The visualizations include: (a) AdaFace original (clean)
embeddings, (b) Post-DVPF AdaFace embeddings, (c) ArcFace original (clean)
embeddings, and (d) Post-DVPF ArcFace embeddings. Figure 14: Normalized
confusion matrices for the FairFace dataset, considering $\mathbf{S}$ as race,
with $\alpha$ values of $0.1$ and $10$.

Figure 15 presents t-SNE visualizations of 10 randomly selected identities
from the IJB-C dataset: (a) and (c) show the original (clean) embeddings from
ArcFace and AdaFace, respectively, while (b) and (d) depict the obfuscated
embeddings of the corresponding FR models using the DVPF (P1) mechanism with
$\alpha=0.1$. Notably, increasing the information leakage weight $\alpha$
results in more overlapping regions among identities in this illustrative 2D
visualization method.

(a)

(b)

(c)

(d)

Figure 15: t-SNE visualizations of 16 randomly selected identities on the
IJB-C dataset: (a) ArcFace, (b) ArcFace with DVPF, (c) AdaFace, (d) AdaFace
with DVPF.

###  6.7 Discussions and Future Directions

####  6.7.1 Contribution of $\mathsf{GenPF}$ for Bias Mitigation

The proposed $\mathsf{GenPF}$ model can also contribute to mitigating bias
through two distinct mechanisms:

##### Generation of Unbiased Synthetic Datasets for Utility Services Training
and Evaluation:

Assuming the conditional generator $g_{\bm{\varphi}}$ possesses the capability
to generate high-fidelity synthetic data conditioned on a random variable
$\mathbf{S}$ supported on set $\mathcal{S}$, the system designer is thus
enabled to produce a synthetic dataset encompassing all potential states of
$\mathbf{S}$. The primary objective in this context is to calibrate the
entropy $\mathrm{H}\left(P_{\mathbf{\widetilde{S}}}\right)$ to be equal to
$\log_{2}|\mathcal{S}|$. Here, $|\mathcal{S}|$ denotes the cardinality, i.e.,
the total number of unique elements contained within $\mathcal{S}$.

##### Learning Invariant Representations with Respect to Variable
$\mathbf{S}$:

Noting that the $\mathsf{GenPF}$ objective (22) forces the latent
representation $\mathbf{S}$ to be independent of the sensitive attribute
$\mathbf{S}$ by minimizing
$\mathrm{H}_{\bm{\phi},\bm{\varphi}}^{\mathrm{U}}\left(\mathbf{X}\mid\mathbf{S},\mathbf{Z}\right)$,
it promotes the representation $\mathbf{Z}$ that is invariant to the variable
$\mathbf{S}$. This is one of the primary goals of the in-processing bias
mitigation techniques in machine learning which is to reduce undesired bias
during the model’s training phase. This approach parallels classical tasks in
computer vision, such as identifying features invariant to covariate factors
like image translation, scaling, and rotation (Lowe, 1999). An analogous
concept is seen in the ‘Fader Network’ (Lample et al., 2017), where the
encoder is adversarially trained to ascertain deterministic feature
representations, invariant to facial attributes.

####  6.7.2 Limitations

##### Optimal Network Architecture:

The pursuit of an optimal network architecture, particularly for the encoder,
utility decoder, and uncertainty decoder, remains a central challenge. This
complexity arises from the need to balance the encoder’s capability to capture
nuanced features with the utility decoder’s and the (conditional) uncertainty
decoder’s abilities to reconstruct utility data and generate conditioned data.
Determining the most effective architecture necessitates a nuanced
understanding of the interplay between these components, which is highly
dependent on the specific dataset and application domain under consideration.

##### Fine-tuning Limitations:

The model’s complexity, compounded by the extensive array of hyper-parameters,
introduces significant fine-tuning limitations. These constraints not only
hinder the optimization process but also limit the model’s adaptability to new
datasets. The relationship between hyper-parameter configurations and model
performance emphasizes the necessity for advanced methods in hyper-parameter
optimization to navigate this complex landscape effectively.

##### Alternative Learning Algorithms:

The exploration of alternative learning algorithms represents a promising
direction to address the current model’s architectural and fine-tuning
challenges. Such algorithms could provide more sophisticated mechanisms for
managing the model’s complexity, enhancing its adaptability, and improving
scalability across various datasets.

##### Challenges with Fixed Pretrained Backbones:

Employing fixed pretrained backbones, such as those from face recognition
models, without the ability to fine-tune, poses specific challenges. This
limitation can significantly impact the model’s flexibility and performance,
underscoring the need for strategies that can adapt to or compensate for the
constraints of using fixed pre-trained models.

####  6.7.3 Future Directions

##### Integration with Prior-Independent Privacy Mechanisms:

Regarding future directions, integrating prior-independent privacy mechanisms,
such as differential privacy, with our deep privacy funnel model—whether
discriminative or generative—offers a promising research avenue. This
integration, effectively combining prior-dependent and prior-independent
mechanisms, could significantly enhance our model’s privacy protections. We
can ensure comprehensive privacy assurances across various scenarios by
addressing both ‘context-free’ and ‘context-aware’ privacy definitions.

##### Expanding Model Capabilities:

Future research should also explore extending various sections of our general
model formulation by employing alternative methods in both the generative and
discriminative components. In terms of generative modeling, recent diffusion
models have demonstrated significant generative capabilities compared to other
generative modeling approaches, such as GANs and VAEs, especially regarding
the stability of training and the fidelity of generated data. Similarly, for
the discriminative component, the exploration of other architectures, like
Vision Transformers (ViTs), should be considered. These architectures offer
superior representation of the relationships between different parts of images
due to their inherent inductive bias. Such adaptability would enable a broader
range of applications, catering to diverse data types and addressing privacy
concerns more effectively.

##  7 Conclusion

This study marks the first integration of privacy funnel analysis into face
recognition systems, bridging the gap between information-theoretic privacy
and practical deep learning applications. We introduced the generative privacy
funnel ($\mathsf{GenPF}$) alongside the discriminative privacy funnel
($\mathsf{DisPF}$), offering new insights into synthetic data generation with
privacy guarantees. Our deep variational privacy funnel (DVPF) model, applied
to state-of-the-art face recognition systems, demonstrates a quantifiable
balance between information obfuscation and utility. Experimental results
using advanced FR architectures and datasets highlight the effectiveness of
our approach, especially in reducing information leakage about sensitive
attributes. Crucially, we evaluated the trained DVPF networks on the
challenging IJB-C test dataset. This work provides a robust framework and
versatile tools for future privacy-preserving research in facial recognition
technologies, with an accompanying reproducible software package facilitating
further research exploration and adoption.

## Acknowledgement

This research is supported by the Swiss Center for Biometrics Research and
Testing at the Idiap Research Institute. It is also conducted as part of the
SAFER project, which received support from the Hasler Foundation under the
Responsible AI program.

## References

  * Abadi et al. (2016) Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang.  Deep learning with differential privacy.  In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ , pages 308–318, 2016.
  * Abdullahi et al. (2024) Sani M Abdullahi, Shuifa Sun, Beng Wang, Ning Wei, and Hongxia Wang.  Biometric template attacks and recent protection mechanisms: A survey.  _Information Fusion_ , 103:102144, 2024.
  * Abdullakutty et al. (2021) Faseela Abdullakutty, Eyad Elyan, and Pamela Johnston.  A review of state-of-the-art in face presentation attack detection: From early development to advanced deep learning and multi-modal fusion methods.  _Information fusion_ , 75:55–69, 2021.
  * Agrawal and Srikant (2000) Rakesh Agrawal and Ramakrishnan Srikant.  Privacy-preserving data mining.  In _Proceedings of the 2000 ACM SIGMOD international conference on Management of data_ , pages 439–450, 2000.
  * Alemi et al. (2016) Alexander A Alemi, Ian Fischer, Joshua V Dillon, and Kevin Murphy.  Deep variational information bottleneck.  _arXiv preprint arXiv:1612.00410_ , 2016.
  * Ali and Silvey (1966) Syed Mumtaz Ali and Samuel D Silvey.  A general class of coefficients of divergence of one distribution from another.  _Journal of the Royal Statistical Society: Series B (Methodological)_ , 28(1):131–142, 1966.
  * Alzantot et al. (2019) Moustafa Alzantot, Yash Sharma, Supriyo Chakraborty, Huan Zhang, Cho-Jui Hsieh, and Mani B Srivastava.  Genattack: Practical black-box attacks with gradient-free optimization.  In _Proceedings of the genetic and evolutionary computation conference_ , pages 1111–1119, 2019.
  * Amjad and Geiger (2019) Rana Ali Amjad and Bernhard Claus Geiger.  Learning representations for neural network-based classification using the information bottleneck principle.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2019.
  * Amos et al. (2016) Brandon Amos, Bartosz Ludwiczuk, and Mahadev Satyanarayanan.  Openface: A general-purpose face recognition library with mobile applications.  Technical report, CMU-CS-16-118, CMU School of Computer Science, 2016\.
  * Arimoto (1977) Suguru Arimoto.  Information measures and capacity of order $\alpha$ for discrete memoryless channels.  _Topics in Information Theory_ , 16:41–52, 1977.
  * Asoodeh and Calmon (2020) Shahab Asoodeh and Flavio P Calmon.  Bottleneck problems: An information and estimation-theoretic view.  _Entropy_ , 22(11):1325, 2020.
  * Asoodeh et al. (2014) Shahab Asoodeh, Fady Alajaji, and Tamás Linder.  Notes on information-theoretic privacy.  In _52nd Annual Allerton Conference on Communication, Control, and Computing_ , pages 1272–1278. IEEE, 2014.
  * Asoodeh et al. (2016) Shahab Asoodeh, Mario Diaz, Fady Alajaji, and Tamás Linder.  Information extraction under privacy constraints.  _Information_ , 7(1):15, 2016.
  * Asoodeh et al. (2018) Shahab Asoodeh, Mario Diaz, Fady Alajaji, and Tamás Linder.  Estimation efficiency under privacy constraints.  _IEEE Transactions on Information Theory_ , 65(3):1512–1534, 2018.
  * Asoodeh et al. (2021) Shahab Asoodeh, Maryam Aliakbarpour, and Flavio P Calmon.  Local differential privacy is equivalent to contraction of an $f$-divergence.  In _2021 IEEE International Symposium on Information Theory (ISIT)_ , pages 545–550. IEEE, 2021.
  * Atashin et al. (2021) Amir Ahooye Atashin, Behrooz Razeghi, Deniz Gündüz, and Slava Voloshynovskiy.  Variational leakage: The role of information complexity in privacy leakage.  In _3rd ACM Workshop on Wireless Security and Machine Learning_ , pages 91–96, 2021.
  * Backes et al. (2016) Michael Backes, Pascal Berrang, Anna Hecksteden, Mathias Humbert, Andreas Keller, and Tim Meyer.  Privacy in epigenetics: Temporal linkability of $\\{$MicroRNA$\\}$ expression profiles.  In _25th USENIX security symposium (USENIX Security 16)_ , pages 1223–1240, 2016.
  * Bang et al. (2019) Seojin Bang, Pengtao Xie, Heewook Lee, Wei Wu, and Eric Xing.  Explaining a black-box using deep variational information bottleneck approach.  _arXiv preprint arXiv:1902.06918_ , 2019.
  * Basciftci et al. (2016) Yuksel Ozan Basciftci, Ye Wang, and Prakash Ishwar.  On privacy-utility tradeoffs for constrained data release mechanisms.  In _Information Theory and Applications Workshop (ITA)_ , pages 1–6. IEEE, 2016.
  * Bassit et al. (2021) Amina Bassit, Florian Hahn, Joep Peeters, Tom Kevenaar, Raymond Veldhuis, and Andreas Peter.  Fast and accurate likelihood ratio-based biometric verification secure against malicious adversaries.  _IEEE transactions on information forensics and security_ , 16:5045–5060, 2021.
  * Batina et al. (2019) Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek.  $\\{$CSI$\\}$$\\{$NN$\\}$: Reverse engineering of neural network architectures through electromagnetic side channel.  In _28th USENIX Security Symposium (USENIX Security 19)_ , pages 515–532, 2019.
  * Beigi and Liu (2020) Ghazaleh Beigi and Huan Liu.  A survey on privacy in social media: Identification, mitigation, and applications.  _ACM Transactions on Data Science_ , 1(1):1–38, 2020.
  * Belghazi et al. (2018) Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeshwar, Sherjil Ozair, Yoshua Bengio, Aaron Courville, and Devon Hjelm.  Mutual information neural estimation.  In _International conference on machine learning_ , pages 531–540. PMLR, 2018.
  * Bhagoji et al. (2018) Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song.  Practical black-box attacks on deep neural networks using efficient query mechanisms.  In _Proceedings of the European conference on computer vision (ECCV)_ , pages 154–169, 2018.
  * Bhowmick et al. (2018) Abhishek Bhowmick, John Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan Rogers.  Protection against reconstruction and its applications in private federated learning.  _arXiv preprint arXiv:1812.00984_ , 2018.
  * Biggio et al. (2012) Battista Biggio, Blaine Nelson, and Pavel Laskov.  Poisoning attacks against support vector machines.  _arXiv preprint arXiv:1206.6389_ , 2012.
  * Biggio et al. (2015) Battista Biggio, Paolo Russu, Luca Didaci, Fabio Roli, et al.  Adversarial biometric recognition: A review on biometric system security from the adversarial machine-learning perspective.  _IEEE Signal Processing Magazine_ , 32(5):31–41, 2015.
  * Bishop and Nasrabadi (2006) Christopher M Bishop and Nasser M Nasrabadi.  _Pattern recognition and machine learning_ , volume 4.  Springer, 2006.
  * Bloch et al. (2021) Matthieu Bloch, Onur Günlü, Aylin Yener, Frédérique Oggier, H Vincent Poor, Lalitha Sankar, and Rafael F Schaefer.  An overview of information-theoretic security and privacy: Metrics, limits and applications.  _IEEE Journal on Selected Areas in Information Theory_ , 2(1):5–22, 2021.
  * Bober-Irizar et al. (2023) Mikel Bober-Irizar, Ilia Shumailov, Yiren Zhao, Robert Mullins, and Nicolas Papernot.  Architectural backdoors in neural networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 24595–24604, 2023.
  * Boddeti (2018) Vishnu Naresh Boddeti.  Secure face matching using fully homomorphic encryption.  In _2018 IEEE 9th International Conference on Biometrics Theory, Applications and Systems (BTAS)_ , pages 1–10. IEEE, 2018.
  * Campbell et al. (2003) Katherine Campbell, Lawrence A Gordon, Martin P Loeb, and Lei Zhou.  The economic cost of publicly announced information security breaches: empirical evidence from the stock market.  _Journal of Computer security_ , 11(3):431–448, 2003.
  * Carlini et al. (2023) Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr.  Poisoning web-scale training datasets is practical.  _arXiv preprint arXiv:2302.10149_ , 2023.
  * Chandrasekaran et al. (2020) Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan.  Exploring connections between active learning and model extraction.  In _29th USENIX Security Symposium (USENIX Security 20)_ , pages 1309–1326, 2020.
  * Chaum (1985) David Chaum.  Security without identification: Transaction systems to make big brother obsolete.  _Communications of the ACM_ , 28(10):1030–1044, 1985.
  * Chaum (1981) David L Chaum.  Untraceable electronic mail, return addresses, and digital pseudonyms.  _Communications of the ACM_ , 24(2):84–90, 1981\.
  * Chen et al. (2023) Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu.  Advdiffuser: Natural adversarial example synthesis with diffusion models.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pages 4562–4572, 2023.
  * Cramer et al. (2015) Ronald Cramer, Ivan Bjerre Damgård, et al.  _Secure multiparty computation_.  Cambridge University Press, 2015.
  * Csiszár (1967) Imre Csiszár.  Information-type measures of difference of probability distributions and indirect observation.  _studia scientiarum Mathematicarum Hungarica_ , 2:229–318, 1967.
  * Csiszár et al. (2004) Imre Csiszár, Paul C Shields, et al.  Information theory and statistics: A tutorial.  _Foundations and Trends® in Communications and Information Theory_ , 1(4):417–528, 2004.
  * de Freitas and Geiger (2022) João Machado de Freitas and Bernhard C Geiger.  Funck: Information funnels and bottlenecks for invariant representation learning.  _arXiv preprint arXiv:2211.01446_ , 2022.
  * Deng et al. (2019a) Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou.  Arcface: Additive angular margin loss for deep face recognition.  In _IEEE/CVF CVPR_ , 2019a.  doi:10.1109/CVPR.2019.00482.
  * Deng et al. (2019b) Jiankang Deng, Jia Guo, Debing Zhang, Yafeng Deng, Xiangju Lu, and Song Shi.  Lightweight face recognition challenge.  In _IEEE/CVF ICCV Workshops_ , 2019b.
  * Diaz et al. (2019) Mario Diaz, Hao Wang, Flavio P. Calmon, and Lalitha Sankar.  On the robustness of information-theoretic privacy measures and mechanisms.  _IEEE Transactions on Information Theory_ , 66(4):1949–1978, 2019.
  * Diffie and Hellman (1976) Whitfield Diffie and Martin E Hellman.  New directions in cryptography.  _IEEE Transactions on Information Theory_ , 1976.
  * Ding and Sadeghi (2019) Ni Ding and Parastoo Sadeghi.  A submodularity-based clustering algorithm for the information bottleneck and privacy funnel.  In _IEEE Information Theory Workshop (ITW)_ , pages 1–5. IEEE, 2019\.
  * Donsker and Varadhan (1983) Monroe D Donsker and SR Srinivasa Varadhan.  Asymptotic evaluation of certain markov process expectations for large time. iv.  _Communications on pure and applied mathematics_ , 36(2):183–212, 1983.
  * Du and Atallah (2001) Wenliang Du and Mikhail J Atallah.  Secure multi-party computation problems and their applications: a review and open problems.  In _Proceedings of the 2001 workshop on New security paradigms_ , pages 13–22, 2001.
  * Duchi (2016) John Duchi.  Lecture notes for statistics 311/electrical engineering 377.  _URL: https://stanford. edu/class/stats311/Lectures/full notes._ , 2, 2016.
  * Duchi et al. (2013a) John C Duchi, Michael I Jordan, and Martin J Wainwright.  Local privacy, data processing inequalities, and statistical minimax rates.  _arXiv preprint arXiv:1302.3203_ , 2013a.
  * Duchi et al. (2013b) John C Duchi, Michael I Jordan, and Martin J Wainwright.  Local privacy and statistical minimax rates.  In _2013 IEEE 54th Annual Symposium on Foundations of Computer Science_ , pages 429–438. IEEE, 2013b.
  * Duchi et al. (2014) John C Duchi, Michael I Jordan, and Martin J Wainwright.  Privacy aware learning.  _Journal of the ACM (JACM)_ , 61(6):1–57, 2014\.
  * Duchi et al. (2018) John C Duchi, Michael I Jordan, and Martin J Wainwright.  Minimax optimal procedures for locally private estimation.  _Journal of the American Statistical Association_ , 113(521):182–201, 2018.
  * Dunne (1994) Robert L Dunne.  Deterring unauthorized access to computers: Controlling behavior in cyberspace through a contract law paradigm.  _Jurimetrics J._ , 35:1, 1994.
  * Duta et al. (2021) Ionut Cosmin Duta, Li Liu, Fan Zhu, and Ling Shao.  Improved residual networks for image and video recognition.  In _25th International Conference on Pattern Recognition (ICPR)_ , pages 9415–9422. IEEE, 2021.
  * Dwivedi et al. (2019) Ashutosh Dhar Dwivedi, Gautam Srivastava, Shalini Dhar, and Rajani Singh.  A decentralized privacy-preserving healthcare blockchain for iot.  _Sensors_ , 19(2):326, 2019.
  * Dwork et al. (2006a) Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor.  Our data, ourselves: Privacy via distributed noise generation.  In _Advances in Cryptology-EUROCRYPT 2006: 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, St. Petersburg, Russia, May 28-June 1, 2006. Proceedings 25_ , pages 486–503. Springer, 2006a.
  * Dwork et al. (2006b) Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith.  Calibrating noise to sensitivity in private data analysis.  In _Theory of Cryptography Conference_ , pages 265–284. Springer, 2006b.
  * Dwork et al. (2014) Cynthia Dwork, Aaron Roth, et al.  The algorithmic foundations of differential privacy.  _Foundations and Trends® in Theoretical Computer Science_ , 9(3–4):211–407, 2014.
  * Dwork et al. (2017) Cynthia Dwork, Adam Smith, Thomas Steinke, and Jonathan Ullman.  Exposed! a survey of attacks on private data.  _Annual Review of Statistics and Its Application_ , 4:61–84, 2017.
  * Edwards and Storkey (2016) Harrison Edwards and Amos Storkey.  Censoring representations with an adversary.  In _International Conference on Learning Representation (ICLR)_ , 2016\.
  * Effing et al. (2011) Robin Effing, Jos Van Hillegersberg, and Theo Huibers.  Social media and political participation: are facebook, twitter and youtube democratizing our political systems?  In _Electronic Participation: Third IFIP WG 8.5 International Conference, ePart 2011, Delft, The Netherlands, August 29–September 1, 2011. Proceedings 3_ , pages 25–35. Springer, 2011.
  * El Emam et al. (2011) Khaled El Emam, Elizabeth Jonker, Luk Arbuckle, and Bradley Malin.  A systematic review of re-identification attacks on health data.  _PloS one_ , 6(12):e28071, 2011.
  * Evfimievski et al. (2003) Alexandre Evfimievski, Johannes Gehrke, and Ramakrishnan Srikant.  Limiting privacy breaches in privacy preserving data mining.  In _22th ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems_ , pages 211–222. ACM, 2003.
  * Federici et al. (2020) Marco Federici, Anjan Dutta, Patrick Forré, Nate Kushman, and Zeynep Akata.  Learning robust representations via multi-view information bottleneck.  _International Conference on Learning Representations (ICLR)_ , 2020\.
  * Ferdowsi et al. (2020) Sohrab Ferdowsi, Behrooz Razeghi, Taras Holotyak, Flavio P Calmon, and Slava Voloshynovskiy.  Privacy-preserving image sharing via sparsifying layers on convolutional groups.  In _IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , pages 2797–2801. IEEE, 2020.
  * Fiege et al. (1987) Uriel Fiege, Amos Fiat, and Adi Shamir.  Zero knowledge proofs of identity.  In _Proceedings of the nineteenth annual ACM symposium on Theory of computing_ , pages 210–217, 1987.
  * Fischer (2020) Ian Fischer.  The conditional entropy bottleneck.  _arXiv preprint arXiv:2002.05379_ , 2020.
  * Galbally et al. (2010) Javier Galbally, Chris McCool, Julian Fierrez, Sebastien Marcel, and Javier Ortega-Garcia.  On the vulnerability of face verification systems to hill-climbing attacks.  _Pattern Recognition_ , 43(3):1027–1038, 2010\.
  * Goldfeld and Polyanskiy (2020) Ziv Goldfeld and Yury Polyanskiy.  The information bottleneck problem and its applications in machine learning.  _IEEE Journal on Selected Areas in Information Theory_ , 2020.
  * Goldreich (1998) Oded Goldreich.  Secure multi-party computation.  _Manuscript. Preliminary version_ , 78(110), 1998.
  * Goldreich and Oren (1994) Oded Goldreich and Yair Oren.  Definitions and properties of zero-knowledge proof systems.  _Journal of Cryptology_ , 7(1):1–32, 1994.
  * Gong et al. (2020) Sixue Gong, Xiaoming Liu, and Anil K Jain.  Jointly de-biasing face recognition and demographic attribute estimation.  In _Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIX 16_ , pages 330–347. Springer, 2020.
  * Grover and Mark (2017) Ted Grover and Gloria Mark.  Digital footprints: Predicting personality from temporal patterns of technology use.  In _Proceedings of the 2017 acm international joint conference on pervasive and ubiquitous computing and proceedings of the 2017 acm international symposium on wearable computers_ , pages 41–44, 2017.
  * Guizzo (2003) Erico Marui Guizzo.  _The essential message: Claude Shannon and the making of information theory_.  PhD thesis, Massachusetts Institute of Technology, 2003.
  * Guo et al. (2019) Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger.  Simple black-box adversarial attacks.  In _International Conference on Machine Learning_ , pages 2484–2493. PMLR, 2019.
  * Guo and Liu (2020) Junfeng Guo and Cong Liu.  Practical poisoning attacks on neural networks.  In _Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVII 16_ , pages 142–158. Springer, 2020.
  * Hafez-Kolahi and Kasaei (2019) Hassan Hafez-Kolahi and Shohreh Kasaei.  Information bottleneck and its applications in deep learning.  _Algorithms_ , 3(4):5, 2019.
  * Hafez-Kolahi et al. (2020) Hassan Hafez-Kolahi, Shohreh Kasaei, and Mahdiyeh Soleymani-Baghshah.  Sample complexity of classification with compressed input.  _Neurocomputing_ , 2020.
  * Hahn and Marcel (2022) Vedrana Krivokuća Hahn and Sébastien Marcel.  Biometric template protection for neural-network-based face recognition systems: A survey of methods and evaluation techniques.  _IEEE Transactions on Information Forensics and Security_ , 18:639–666, 2022.
  * Hamm (2017) Jihun Hamm.  Enhancing utility and privacy with noisy minimax filters.  In _IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , pages 6389–6393. IEEE, 2017.
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In _IEEE CVPR_ , 2016.  doi:10.1109/CVPR.2016.90.
  * Hellman (1976) Martin Hellman.  New directions in cryptography.  _IEEE transactions on Information Theory_ , 22(6):644–654, 1976.
  * Hellman (1977) Martin Hellman.  An extension of the shannon theory approach to cryptography.  _IEEE Transactions on Information Theory_ , 23(3):289–294, 1977.
  * Henriksen-Bulmer and Jeary (2016) Jane Henriksen-Bulmer and Sheridan Jeary.  Re-identification attacks—a systematic literature review.  _International Journal of Information Management_ , 36(6):1184–1192, 2016.
  * Howard et al. (2017) Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam.  Mobilenets: Efficient convolutional neural networks for mobile vision applications.  _arXiv preprint arXiv:1704.04861_ , 2017.
  * Hsu et al. (2019) Hsiang Hsu, Shahab Asoodeh, Flávio P. Calmon, and Nadia Fawaz.  Information-theoretic privacy watchdogs.  In _IEEE International Symposium on Information Theory (ISIT)_. IEEE, 2019.
  * Hsu et al. (2020) Hsiang Hsu, Shahab Asoodeh, and Flavio Calmon.  Obfuscation via information density estimation.  In _International Conference on Artificial Intelligence and Statistics (AISTATS)_ , pages 906–917. PMLR, 2020.
  * Hsu et al. (2021) Hsiang Hsu, Natalia Martinez, Martin Bertran, Guillermo Sapiro, and Flavio P Calmon.  A survey on statistical, information, and estimation—theoretic views on privacy.  _IEEE BITS the Information Theory Magazine_ , 1(1):45–56, 2021.
  * Hu et al. (2019) Jie Hu, Rongrong Ji, ShengChuan Zhang, Xiaoshuai Sun, Qixiang Ye, Chia-Wen Lin, and Qi Tian.  Information competing process for learning diversified representations.  In _Advances in Neural Information Processing Systems_ , pages 2175–2186, 2019.
  * Hu et al. (2022) Pingyi Hu, Zihan Wang, Ruoxi Sun, Hu Wang, and Minhui Xue.  M 4 i: Multi-modal models membership inference.  _Advances in Neural Information Processing Systems_ , 35:1867–1882, 2022.
  * Huang et al. (2017) Chong Huang, Peter Kairouz, Xiao Chen, Lalitha Sankar, and Ram Rajagopal.  Context-aware generative adversarial privacy.  _Entropy_ , 19(12):656, 2017.
  * Huang et al. (2018) Chong Huang, Peter Kairouz, Xiao Chen, Lalitha Sankar, and Ram Rajagopal.  Generative adversarial privacy.  _arXiv preprint arXiv:1807.05306_ , 2018.
  * Huang et al. (2008) Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller.  Labeled faces in the wild: A database forstudying face recognition in unconstrained environments.  In _Workshop on faces in’Real-Life’Images: detection, alignment, and recognition_ , 2008.
  * Huang and Gamal (2024) Teng-Hui Huang and Hesham El Gamal.  An efficient difference-of-convex solver for privacy funnel.  _arXiv preprint arXiv:2403.04778_ , 2024.
  * Ilyas et al. (2018) Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin.  Black-box adversarial attacks with limited queries and information.  In _International conference on machine learning_ , pages 2137–2146. PMLR, 2018.
  * ISO/IEC 24745:2022 (E) ISO/IEC 24745:2022(E).  ISO/IEC 24745: 2022(E) Information technologyy, cybersecurity and privacy protection – Biometric Information Protection, Feb 2022.  URL https://www.iso.org/standard/75302.html.
  * Issa et al. (2019) Ibrahim Issa, Aaron B Wagner, and Sudeep Kamath.  An operational approach to information leakage.  _IEEE Transactions on Information Theory_ , 66(3):1625–1657, 2019.
  * James et al. (2013) Gareth James, Daniela Witten, Trevor Hastie, Robert Tibshirani, et al.  _An introduction to statistical learning_ , volume 112.  Springer, 2013.
  * Jin et al. (2004) Andrew Teoh Beng Jin, David Ngo Chek Ling, and Alwyn Goh.  Biohashing: two factor authentication featuring fingerprint data and tokenised random number.  _Pattern Recognition_ , 37(11):2245–2255, 2004\.
  * Jin et al. (2017) Zhe Jin, Jung Yeon Hwang, Yen-Lung Lai, Soohyung Kim, and Andrew Beng Jin Teoh.  Ranking-based locality sensitive hashing-enabled cancelable biometrics: Index-of-max hashing.  _IEEE Transactions on Information Forensics and Security_ , 13(2):393–407, 2017.
  * Juels and Sudan (2006) Ari Juels and Madhu Sudan.  A fuzzy vault scheme.  _Designs, Codes and Cryptography_ , 38(2):237–257, 2006.
  * Juels and Wattenberg (1999) Ari Juels and Martin Wattenberg.  A fuzzy commitment scheme.  In _Proceedings of the 6th ACM Conference on Computer and Communications Security_ , pages 28–36, 1999.
  * Juvekar et al. (2018) Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan.  $\\{$GAZELLE$\\}$: A low latency framework for secure neural network inference.  In _27th USENIX Security Symposium (USENIX Security 18)_ , pages 1651–1669, 2018.
  * Kairouz et al. (2021) Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al.  Advances and open problems in federated learning.  _Foundations and Trends® in Machine Learning_ , 14(1–2):1–210, 2021.
  * Kaissis et al. (2020) Georgios A Kaissis, Marcus R Makowski, Daniel Rückert, and Rickmer F Braren.  Secure, privacy-preserving and federated machine learning in medical imaging.  _Nature Machine Intelligence_ , 2(6):305–311, 2020.
  * Kalantari et al. (2017) Kousha Kalantari, Lalitha Sankar, and Oliver Kosut.  On information-theoretic privacy with general distortion cost functions.  In _IEEE International Symposium on Information Theory (ISIT)_ , pages 2865–2869. IEEE, 2017.
  * Kamat et al. (2009) Pandurang Kamat, Wenyuan Xu, Wade Trappe, and Yanyong Zhang.  Temporal privacy in wireless sensor networks: Theory and practice.  _ACM Transactions on Sensor Networks (TOSN)_ , 5(4):1–24, 2009.
  * Kantorovich (1942) Leonid Kantorovich.  On the transfer of masses (in russian).  In _Doklady Akademii Nauk_ , volume 37, pages 227––229, 1942.
  * Karkkainen and Joo (2021) Kimmo Karkkainen and Jungseock Joo.  Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation.  In _IEEE/CVF Winter Conference on Applications of Computer Vision_ , 2021.
  * Keller (2020) Marcel Keller.  Mp-spdz: A versatile framework for multi-party computation.  In _Proceedings of the 2020 ACM SIGSAC conference on computer and communications security_ , pages 1575–1590, 2020.
  * Kifer and Machanavajjhala (2012) Daniel Kifer and Ashwin Machanavajjhala.  A rigorous and customizable framework for privacy.  In _31st ACM SIGMOD-SIGACT-SIGAI symposium on Principles of Database Systems_ , pages 77–88. ACM, 2012.
  * Kilian (1992) Joe Kilian.  A note on efficient zero-knowledge proofs and arguments.  In _Proceedings of the twenty-fourth annual ACM symposium on Theory of computing_ , pages 723–732, 1992.
  * Kim et al. (2022) Minchul Kim, Anil K Jain, and Xiaoming Liu.  Adaface: Quality adaptive margin for face recognition.  In _IEEE/CVF CVPR_ , 2022.
  * Kingma and Welling (2014) Diederik P Kingma and Max Welling.  Auto-encoding variational bayes.  In _International Conference on Learning Representations (ICLR)_ , 2014.
  * Kirsch et al. (2020) Andreas Kirsch, Clare Lyle, and Yarin Gal.  Unpacking information bottlenecks: Unifying information-theoretic objectives in deep learning.  _arXiv preprint arXiv:2003.12537_ , 2020.
  * Kloukiniotis et al. (2022) A Kloukiniotis, A Papandreou, A Lalos, P Kapsalas, D-V Nguyen, and K Moustakas.  Countering adversarial attacks on autonomous vehicles using denoising techniques: A review.  _IEEE Open Journal of Intelligent Transportation Systems_ , 3:61–80, 2022.
  * Knott et al. (2021) Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten.  Crypten: Secure multi-party computation meets machine learning.  _Advances in Neural Information Processing Systems_ , 34:4961–4973, 2021.
  * Kolchinsky et al. (2019) Artemy Kolchinsky, Brendan D Tracey, and Steven Van Kuyk.  Caveats for information bottleneck in deterministic scenarios.  In _International Conference on Learning Representations (ICLR)_ , 2019.
  * Kurri et al. (2023) Gowtham R Kurri, Lalitha Sankar, and Oliver Kosut.  An operational approach to information leakage via generalized gain functions.  _IEEE Transactions on Information Theory_ , 2023.
  * Lample et al. (2017) Guillaume Lample, Neil Zeghidour, Nicolas Usunier, Antoine Bordes, Ludovic DENOYER, et al.  Fader networks: Manipulating images by sliding attributes.  In _Advances in Neural Information Processing Systems_ , pages 5963–5972, 2017.
  * Layne et al. (2012) Ryan Layne, Timothy M Hospedales, Shaogang Gong, and Q Mary.  Person re-identification by attributes.  In _Bmvc_ , volume 2, page 8, 2012.
  * Leong et al. (2020) Shu-Min Leong, Raphaël C-W Phan, Vishnu Monn Baskaran, and Chee-Pun Ooi.  Privacy-preserving facial recognition based on temporal features.  _Applied Soft Computing_ , 96:106662, 2020.
  * Li et al. (2007) Ninghui Li, Tiancheng Li, and Suresh Venkatasubramanian.  t-closeness: Privacy beyond k-anonymity and l-diversity.  In _IEEE 23rd International Conference on Data Engineering (ICDE)_ , pages 106–115. IEEE, 2007.
  * Li et al. (2023) Wenhao Li, Xiao-Yu Zhang, Huaifeng Bao, Binbin Yang, Zhaoxuan Li, Haichao Shi, and Qiang Wang.  Prism: Real-time privacy protection against temporal network traffic analyzers.  _IEEE Transactions on Information Forensics and Security_ , 2023.
  * Li et al. (2022) Zhiheng Li, Anthony Hoogs, and Chenliang Xu.  Discover and mitigate unknown biases with debiasing alternate networks.  In _European Conference on Computer Vision_ , pages 270–288. Springer, 2022.
  * Liao et al. (2018) Jiachun Liao, Oliver Kosut, Lalitha Sankar, and Flavio P. Calmon.  Privacy under hard distortion constraints.  In _IEEE Information Theory Workshop (ITW)_ , pages 1–5. IEEE, 2018\.
  * Liao et al. (2019) Jiachun Liao, Oliver Kosut, Lalitha Sankar, and Flavio P. Calmon.  Tunable measures for information leakage and applications to privacy-utility tradeoffs.  _IEEE Transactions on Information Theory_ , 65(12):8043–8066, 2019.
  * Liu et al. (2021) Ajian Liu, Zichang Tan, Jun Wan, Yanyan Liang, Zhen Lei, Guodong Guo, and Stan Z Li.  Face anti-spoofing via adversarial cross-modality translation.  _IEEE Transactions on Information Forensics and Security_ , 16:2759–2772, 2021.
  * Liu et al. (2017) Weiyang Liu, Yandong Wen, Zhiding Yu, Ming Li, Bhiksha Raj, and Le Song.  Sphereface: Deep hypersphere embedding for face recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 212–220, 2017.
  * Liu et al. (2016) Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song.  Delving into transferable adversarial examples and black-box attacks.  _arXiv preprint arXiv:1611.02770_ , 2016.
  * Lowe (1999) David G Lowe.  Object recognition from local scale-invariant features.  In _7th IEEE international conference on computer vision_ , volume 2, pages 1150–1157. IEEE, 1999.
  * Lu et al. (2002) Chun Shien Lu, Hong-Yuan Liao, and Martin Kutter.  Denoising and copy attacks resilient watermarking by exploiting prior knowledge at detector.  _IEEE Transactions on Image Processing_ , 11(3):280–292, 2002.
  * Maaten and Hinton (2008) Laurens van der Maaten and Geoffrey Hinton.  Visualizing data using t-sne.  _Journal of machine learning research_ , 9(Nov):2579–2605, 2008.
  * Machanavajjhala et al. (2006) Ashwin Machanavajjhala, Johannes Gehrke, Daniel Kifer, and Muthuramakrishnan Venkitasubramaniam.  l-diversity: Privacy beyond k-anonymity.  In _Data Engineering, 2006. ICDE’06. Proceedings of the 22nd International Conference on_ , pages 24–24. IEEE, 2006.
  * Machanavajjhala et al. (2008) Ashwin Machanavajjhala, Daniel Kifer, John Abowd, Johannes Gehrke, and Lars Vilhuber.  Privacy: Theory meets practice on the map.  In _2008 IEEE 24th international conference on data engineering_ , pages 277–286. IEEE, 2008.
  * Mai et al. (2020) Guangcan Mai, Kai Cao, Xiangyuan Lan, and Pong C Yuen.  Secureface: Face template protection.  _IEEE Transactions on Information Forensics and security_ , 16:262–277, 2020.
  * Maithili et al. (2018) K Maithili, V Vinothkumar, and P Latha.  Analyzing the security mechanisms to prevent unauthorized access in cloud and network security.  _Journal of Computational and Theoretical Nanoscience_ , 15(6-7):2059–2063, 2018.
  * Makhdoumi and Fawaz (2013) Ali Makhdoumi and Nadia Fawaz.  Privacy-utility tradeoff under statistical uncertainty.  In _51st Annual Allerton Conference on Communication, Control, and Computing_ , pages 1627–1634. IEEE, 2013.
  * Makhdoumi et al. (2014) Ali Makhdoumi, Salman Salamatian, Nadia Fawaz, and Muriel Médard.  From the information bottleneck to the privacy funnel.  In _IEEE Information Theory Workshop (ITW)_ , pages 501–505. IEEE, 2014.
  * Marcel et al. (2023) Sébastien Marcel, Julian Fierrez, and Nicholas Evans.  _Handbook of Biometric Anti-Spoofing: Presentation Attack Detection and Vulnerability Assessment_.  Springer, 2023.
  * Maze et al. (2018) Brianna Maze, Jocelyn Adams, James A. Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K. Jain, W. Tyler Niggel, Janet Anderson, Jordan Cheney, and Patrick Grother.  Iarpa janus benchmark - c: Face dataset and protocol.  In _International Conference on Biometrics (ICB)_ , pages 158–165, 2018.  doi:10.1109/ICB2018.2018.00033.
  * McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In _Artificial intelligence and statistics_ , pages 1273–1282. PMLR, 2017.
  * Melzi et al. (2023) Pietro Melzi, Hatef Otroshi Shahreza, Christian Rathgeb, Ruben Tolosana, Ruben Vera-Rodriguez, Julian Fierrez, Sébastien Marcel, and Christoph Busch.  Multi-ive: Privacy enhancement of multiple soft-biometrics in face embeddings.  In _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision_ , pages 323–331, 2023.
  * Mendes and Vilela (2017) Ricardo Mendes and João P Vilela.  Privacy-preserving data mining: methods, metrics, and applications.  _IEEE Access_ , 5:10562–10582, 2017.
  * Micali and Rogaway (1992) Silvio Micali and Phillip Rogaway.  _Secure computation_.  Springer, 1992.
  * Milne et al. (2017) George R Milne, George Pettinico, Fatima M Hajjat, and Ereni Markos.  Information sensitivity typology: Mapping the degree and type of risk consumers perceive in personal data sharing.  _Journal of Consumer Affairs_ , 51(1):133–161, 2017.
  * Mironov (2017) Ilya Mironov.  Rényi differential privacy.  In _2017 IEEE 30th computer security foundations symposium (CSF)_ , pages 263–275. IEEE, 2017.
  * Mo et al. (2022) Fan Mo, Zahra Tarkhani, and Hamed Haddadi.  Sok: machine learning with confidential computing.  _arXiv preprint arXiv:2208.10134_ , 2022.
  * Mohammed (2012) Ishaq Azhar Mohammed.  Analysis of identity and access management alternatives for a multinational information-sharing environment.  _INTERNATIONAL JOURNAL OF ADVANCED AND INNOVATIVE RESEARCH_ , 1(8):1–7, 2012.
  * Mohassel and Rindal (2018) Payman Mohassel and Peter Rindal.  Aby3: A mixed protocol framework for machine learning.  In _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_ , pages 35–52, 2018.
  * Monge (1781) Gaspar Monge.  Mémoire sur la théorie des déblais et des remblais.  _Histoire de l’Académie Royale des Sciences de Paris, avec les Mémoires de Mathématique et de Physique pour la même année_ , pages 666–704, 1781.
  * Morales et al. (2020) Aythami Morales, Julian Fierrez, Ruben Vera-Rodriguez, and Ruben Tolosana.  Sensitivenets: Learning agnostic representations with application to face images.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 43(6):2158–2164, 2020.
  * Muslukhov et al. (2013) Ildar Muslukhov, Yazan Boshmaf, Cynthia Kuo, Jonathan Lester, and Konstantin Beznosov.  Know your enemy: the risk of unauthorized access in smartphones by insiders.  In _Proceedings of the 15th international conference on Human-computer interaction with mobile devices and services_ , pages 271–280, 2013\.
  * Nandakumar and Jain (2015) Karthik Nandakumar and Anil K Jain.  Biometric template protection: Bridging the performance gap between theory and practice.  _IEEE Signal Processing Magazine_ , 32(5):88–100, 2015.
  * Narayanan and Shmatikov (2008) Arvind Narayanan and Vitaly Shmatikov.  Robust de-anonymization of large sparse datasets.  In _2008 IEEE Symposium on Security and Privacy (sp 2008)_ , pages 111–125. IEEE, 2008.
  * Neel et al. (2021) Seth Neel, Aaron Roth, and Saeed Sharifi-Malvajerdi.  Descent-to-delete: Gradient-based methods for machine unlearning.  In _Algorithmic Learning Theory_ , pages 931–962. PMLR, 2021.
  * Nguyen et al. (2010) XuanLong Nguyen, Martin J Wainwright, and Michael I Jordan.  Estimating divergence functionals and the likelihood ratio by convex risk minimization.  _IEEE Transactions on Information Theory_ , 56(11):5847–5861, 2010.
  * Orekondy et al. (2017) Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz.  Towards a visual privacy advisor: Understanding and predicting privacy risks in images.  In _Proceedings of the IEEE international conference on computer vision_ , pages 3686–3695, 2017.
  * Oseni et al. (2021) Ayodeji Oseni, Nour Moustafa, Helge Janicke, Peng Liu, Zahir Tari, and Athanasios Vasilakos.  Security and privacy for artificial intelligence: Opportunities and challenges.  _arXiv preprint arXiv:2102.04661_ , 2021.
  * Osia et al. (2018) Seyed Ali Osia, Ali Taheri, Ali Shahin Shamsabadi, Kleomenis Katevas, Hamed Haddadi, and Hamid R Rabiee.  Deep private-feature extraction.  _IEEE Transactions on Knowledge and Data Engineering_ , 32(1):54–66, 2018.
  * O’reilly et al. (2018) Michelle O’reilly, Nisha Dogra, Natasha Whiteman, Jason Hughes, Seyda Eruyar, and Paul Reilly.  Is social media bad for mental health and wellbeing? exploring the perspectives of adolescents.  _Clinical child psychology and psychiatry_ , 23(4):601–613, 2018.
  * P. Calmon (2015) Flavio P. Calmon.  _Information-theoretic metrics for security and privacy_.  PhD thesis, Massachusetts Institute of Technology, Department of Electrical Engineering …, 2015.
  * P. Calmon and Fawaz (2012) Flavio P. Calmon and Nadia Fawaz.  Privacy against statistical inference.  In _50th Annual Allerton Conference on Communication, Control, and Computing_ , pages 1401–1408. IEEE, 2012.
  * P. Calmon et al. (2013) Flavio P. Calmon, Mayank Varia, Muriel Médard, Mark M Christiansen, Ken R Duffy, and Stefano Tessaro.  Bounds on inference.  In _51st Annual Allerton Conference on Communication, Control, and Computing_ , pages 567–574. IEEE, 2013.
  * P. Calmon et al. (2015) Flavio P. Calmon, Ali Makhdoumi, and Muriel Médard.  Fundamental limits of perfect privacy.  In _IEEE International Symposium on Information Theory (ISIT)_ , pages 1796–1800. IEEE, 2015.
  * Papernot et al. (2017) Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami.  Practical black-box attacks against machine learning.  In _Proceedings of the 2017 ACM on Asia conference on computer and communications security_ , pages 506–519, 2017.
  * Park et al. (2021) Sungho Park, Sunhee Hwang, Dohyung Kim, and Hyeran Byun.  Learning disentangled representation for fair facial attribute classification via fairness-aware information alignment.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 35, pages 2403–2411, 2021.
  * Peyré et al. (2019) Gabriel Peyré, Marco Cuturi, et al.  Computational optimal transport: With applications to data science.  _Foundations and Trends® in Machine Learning_ , 11(5-6):355–607, 2019.
  * Polyanskiy and Wu (2014) Yury Polyanskiy and Yihong Wu.  Lecture notes on information theory.  _Lecture Notes for ECE563 (UIUC) and_ , 6, 2014.
  * Polyanskiy et al. (2010) Yury Polyanskiy, H Vincent Poor, and Sergio Verdú.  Channel coding rate in the finite blocklength regime.  _IEEE Transactions on Information Theory_ , 56(5):2307–2359, 2010.
  * Porkodi et al. (2018) V Porkodi, M Sivaram, Amin Salih Mohammed, and V Manikandan.  Survey on white-box attacks and solutions.  _Asian Journal of Computer Science and Technology_ , 7(3):28–32, 2018.
  * Price (1982) Robert Price.  E.“claude e. shannon: An interview conducted by robert price”.  _IEEE History Center, Interview_ , 423:28, 1982.  URL https://ethw.org/Oral-History:Claude_E._Shannon.
  * Prokofiev et al. (2018) Anton O Prokofiev, Yulia S Smirnova, and Vasiliy A Surov.  A method to detect internet of things botnets.  In _2018 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus)_ , pages 105–108. IEEE, 2018\.
  * Qi et al. (2020) Lianyong Qi, Chunhua Hu, Xuyun Zhang, Mohammad R Khosravi, Suraj Sharma, Shaoning Pang, and Tian Wang.  Privacy-aware data fusion and prediction with spatial-temporal context for smart city industrial environment.  _IEEE Transactions on Industrial Informatics_ , 17(6):4159–4167, 2020.
  * Rahmati et al. (2020) Ali Rahmati, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Huaiyu Dai.  Geoda: a geometric framework for black-box adversarial attacks.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 8446–8455, 2020.
  * Ramirez et al. (2022) Miguel A Ramirez, Song-Kyoo Kim, Hussam Al Hamadi, Ernesto Damiani, Young-Ji Byon, Tae-Yeon Kim, Chung-Suk Cho, and Chan Yeob Yeun.  Poisoning attacks and defenses on artificial intelligence: A survey.  _arXiv preprint arXiv:2202.10276_ , 2022.
  * Rassouli and Gündüz (2018) Borzoo Rassouli and Deniz Gündüz.  On perfect privacy.  In _IEEE International Symposium on Information Theory (ISIT)_ , pages 2551–2555. IEEE, 2018.
  * Rassouli and Gündüz (2019) Borzoo Rassouli and Deniz Gündüz.  Optimal utility-privacy trade-off with total variation distance as a privacy measure.  _IEEE Transactions on Information Forensics and Security_ , 15:594–603, 2019.
  * Rassouli et al. (2018) Borzoo Rassouli, Fernando Rosas, and Deniz Gündüz.  Latent feature disclosure under perfect sample privacy.  In _IEEE International Workshop on Information Forensics and Security (WIFS)_ , pages 1–7. IEEE, 2018.
  * Rassouli et al. (2019) Borzoo Rassouli, Fernando E Rosas, and Deniz Gündüz.  Data disclosure under perfect sample privacy.  _IEEE Transactions on Information Forensics and Security_ , 2019.
  * Rathgeb et al. (2022) Christian Rathgeb, Johannes Merkle, Johanna Scholz, Benjamin Tams, and Vanessa Nesterowicz.  Deep face fuzzy vault: Implementation and performance.  _Computers & Security_, 113:102539, 2022.
  * Razeghi (2023) Behrooz Razeghi.  _Bottlenecks CLUB: Unifying information-theoretic trade-offs among complexity, leakage, and utility_.  PhD thesis, University of Geneva, Department of Computer Science, 2023\.  DOI: 10.13097/archive-ouverte/unige:174561.
  * Razeghi et al. (2017) Behrooz Razeghi, Slava Voloshynovskiy, Dimche Kostadinov, and Olga Taran.  Privacy preserving identification using sparse approximation with ambiguization.  In _IEEE International Workshop on Information Forensics and Security (WIFS)_ , pages 1–6, Rennes, France, December 2017.
  * Razeghi et al. (2018) Behrooz Razeghi, Slava Voloshynovskiy, Sohrab Ferdowsi, and Dimche Kostadinov.  Privacy-preserving identification via layered sparse code design: Distributed servers and multiple access authorization.  In _26th European Signal Processing Conference (EUSIPCO)_ , pages 2578–2582. IEEE, 2018.
  * Razeghi et al. (2020) Behrooz Razeghi, Flavio P. Calmon, Deniz Gündüz, and Slava Voloshynovskiy.  On perfect obfuscation: Local information geometry analysis.  In _IEEE International Workshop on Information Forensics and Security (WIFS)_ , pages 1–6, 2020.
  * Razeghi et al. (2023) Behrooz Razeghi, Flavio P Calmon, Deniz Gunduz, and Slava Voloshynovskiy.  Bottlenecks club: Unifying information-theoretic trade-offs among complexity, leakage, and utility.  _IEEE Transactions on Information Forensics and Security_ , 18:2060–2075, 2023.
  * Razeghi et al. (2024) Behrooz Razeghi, Parsa Rahimi, and Sébastien Marcel.  Deep variational privacy funnel: General modeling with applications in face recognition.  In _IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2024.  URL https://arxiv.org/pdf/2401.14792.
  * Rebollo-Monedero et al. (2009) David Rebollo-Monedero, Jordi Forne, and Josep Domingo-Ferrer.  From t-closeness-like privacy to postrandomization via information theory.  _IEEE Transactions on Knowledge and Data Engineering_ , 22(11):1623–1636, 2009.
  * Reed (1973) Irving S Reed.  Information theory and privacy in data banks.  In _National Computer Conference and Exposition_ , pages 581–587. ACM, 1973.
  * Rényi (1959) Alfréd Rényi.  On measures of dependence.  _Acta mathematica hungarica_ , 10(3-4):441–451, 1959.
  * Rényi (1961) Alfréd Rényi.  On measures of entropy and information.  In _Proceedings of the Fourth Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Contributions to the Theory of Statistics_ , volume 4, pages 547–562. University of California Press, 1961.
  * Rezaeifar et al. (2019) Shideh Rezaeifar, Behrooz Razeghi, Olga Taran, Taras Holotyak, and Slava Voloshynovskiy.  Reconstruction of privacy-sensitive data from protected templates.  In _IEEE International Conference on Image Processing (ICIP)_ , Taipei, Taiwan, September 2019.
  * Ricanek and Tesafaye (2006) K. Ricanek and T. Tesafaye.  Morph: a longitudinal image database of normal adult age-progression.  In _International Conference on Automatic Face and Gesture Recognition_ , 2006.  doi:10.1109/FGR.2006.78.
  * Sablayrolles et al. (2019) Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou.  White-box vs black-box: Bayes optimal strategies for membership inference.  In _International Conference on Machine Learning_ , pages 5558–5567. PMLR, 2019.
  * Sabt et al. (2015) Mohamed Sabt, Mohammed Achemlal, and Abdelmadjid Bouabdallah.  Trusted execution environment: what it is, and what it is not.  In _2015 IEEE Trustcom/BigDataSE/Ispa_ , volume 1, pages 57–64. IEEE, 2015.
  * Saeidian et al. (2021) Sara Saeidian, Giulia Cervia, Tobias J Oechtering, and Mikael Skoglund.  Quantifying membership privacy via information leakage.  _IEEE Transactions on Information Forensics and Security_ , 16:3096–3108, 2021.
  * Saeidian et al. (2023) Sara Saeidian, Giulia Cervia, Tobias J Oechtering, and Mikael Skoglund.  Pointwise maximal leakage.  _IEEE Transactions on Information Theory_ , 2023.
  * Salamatian et al. (2015) Salman Salamatian, Amy Zhang, Flavio P. Calmon, Sandilya Bhamidipati, Nadia Fawaz, Branislav Kveton, Pedro Oliveira, and Nina Taft.  Managing your private and public data: Bringing down inference attacks against your privacy.  _IEEE Journal of Selected Topics in Signal Processing_ , 9(7):1240–1255, 2015.
  * Sandhya and Prasad (2017) Mulagala Sandhya and Munaga VNK Prasad.  Biometric template protection: A systematic literature review of approaches and modalities.  In _Biometric Security and Privacy_ , pages 323–370. Springer, 2017\.
  * Sankar et al. (2013) Lalitha Sankar, S Raj Rajagopalan, and H Vincent Poor.  Utility-privacy tradeoffs in databases: An information-theoretic approach.  _IEEE Transactions on Information Forensics and Security (TIFS)_ , 8(6):838–852, 2013.
  * Schroff et al. (2015) Florian Schroff, Dmitry Kalenichenko, and James Philbin.  Facenet: A unified embedding for face recognition and clustering.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 815–823, 2015.
  * Séjourné et al. (2023) Thibault Séjourné, Gabriel Peyré, and François-Xavier Vialard.  Unbalanced optimal transport, from theory to numerics.  _Handbook of Numerical Analysis_ , 24:407–471, 2023.
  * Shahreza and Marcel (2023a) Hatef Otroshi Shahreza and Sébastien Marcel.  Face reconstruction from facial templates by learning latent space of a generator network.  In _Thirty-seventh Conference on Neural Information Processing Systems_ , 2023a.
  * Shahreza and Marcel (2023b) Hatef Otroshi Shahreza and Sébastien Marcel.  Comprehensive vulnerability evaluation of face recognition systems to template inversion attacks via 3d face reconstruction.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2023b.
  * Shahreza et al. (2022) Hatef Otroshi Shahreza, Christian Rathgeb, Dailé Osorio-Roig, Vedrana Krivokuća Hahn, Sébastien Marcel, and Christoph Busch.  Hybrid protection of biometric templates by combining homomorphic encryption and cancelable biometrics.  In _2022 IEEE International Joint Conference on Biometrics (IJCB)_ , pages 1–10. IEEE, 2022.
  * Shahreza et al. (2023a) Hatef Otroshi Shahreza, Vedrana Krivokuća Hahn, and Sébastien Marcel.  Mlp-hash: Protecting face templates via hashing of randomized multi-layer perceptron.  In _2023 31st European Signal Processing Conference (EUSIPCO)_ , pages 605–609. IEEE, 2023a.
  * Shahreza et al. (2023b) Hatef Otroshi Shahreza, Yanina Y Shkel, and Sébastien Marcel.  Measuring linkability of protected biometric templates using maximal leakage.  _IEEE Transactions on Information Forensics and Security_ , 2023b.
  * Shannon (1949) Claude E Shannon.  Communication theory of secrecy systems.  _The Bell system technical journal_ , 28(4):656–715, 1949.
  * Sharma and Warsi (2013) Naresh Sharma and Naqueeb Ahmad Warsi.  Fundamental bound on the reliability of quantum information transmission.  _Physical review letters_ , 110(8):080501, 2013\.
  * Shiri et al. (2023) Isaac Shiri, Behrooz Razeghi, Alireza Vafaei Sadr, Mehdi Amini, Yazdan Salimi, Sohrab Ferdowsi, Peter Boor, Deniz Gündüz, Slava Voloshynovskiy, and Habib Zaidi.  Multi-institutional pet/ct image segmentation using federated deep transformer learning.  _Computer Methods and Programs in Biomedicine_ , 240:107706, 2023.
  * Shiri et al. (2024) Isaac Shiri, Behrooz Razeghi, Sohrab Ferdowsi, Yazdan Salimi, Deniz Gündüz, Douglas Teodoro, Slava Voloshynovskiy, and Habib Zaidi.  Primis: Privacy-preserving medical image sharing via deep sparsifying transform learning with obfuscation.  _Journal of biomedical informatics_ , 150:104583, 2024.
  * Shokri and Shmatikov (2015) Reza Shokri and Vitaly Shmatikov.  Privacy-preserving deep learning.  In _22nd ACM SIGSAC Conference on Computer and Communications Security_ , pages 1310–1321, 2015.
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In _2017 IEEE symposium on security and privacy (SP)_ , pages 3–18. IEEE, 2017.
  * Simonyan and Zisserman (2014) Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  _arXiv preprint arXiv:1409.1556_ , 2014.
  * Sloan and Warner (2017) Robert Sloan and Richard Warner.  _Unauthorized access: The crisis in online privacy and security_.  Taylor & Francis, 2017.
  * Smith et al. (2011) H Jeff Smith, Tamara Dinev, and Heng Xu.  Information privacy research: an interdisciplinary review.  _MIS quarterly_ , pages 989–1015, 2011.
  * Solove (2002) Daniel J Solove.  Conceptualizing privacy.  _California law review_ , pages 1087–1155, 2002.
  * Solove (2005) Daniel J Solove.  A taxonomy of privacy.  _U. Pa. l. Rev._ , 154:477, 2005.
  * Solove (2010) Daniel J Solove.  _Understanding privacy_.  Harvard university press, 2010.
  * Solove (2024) Daniel J Solove.  Artificial intelligence and privacy.  _Available at SSRN_ , 2024.
  * Song et al. (2019) Liwei Song, Reza Shokri, and Prateek Mittal.  Privacy risks of securing machine learning models against adversarial examples.  In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_ , pages 241–257, 2019.
  * Sreekumar and Gündüz (2019) Sreejith Sreekumar and Deniz Gündüz.  Optimal privacy-utility trade-off under a rate constraint.  In _IEEE International Symposium on Information Theory (ISIT)_ , pages 2159–2163. IEEE, 2019.
  * Stock et al. (2022) Pierre Stock, Igor Shilov, Ilya Mironov, and Alexandre Sablayrolles.  Defending against reconstruction attacks with r$\backslash$’enyi differential privacy.  _arXiv preprint arXiv:2202.07623_ , 2022.
  * Strouse and Schwab (2017) DJ Strouse and David J Schwab.  The deterministic information bottleneck.  _Neural computation_ , 29(6):1611–1630, 2017\.
  * Su et al. (2017) Jessica Su, Ansh Shukla, Sharad Goel, and Arvind Narayanan.  De-anonymizing web browsing data with social networks.  In _Proceedings of the 26th international conference on world wide web_ , pages 1261–1269, 2017.
  * Sugiyama et al. (2012) Masashi Sugiyama, Taiji Suzuki, and Takafumi Kanamori.  Density-ratio matching under the Bregman divergence: A unified framework of density-ratio estimation.  _Annals of the Institute of Statistical Mathematics_ , 64(5):1009–1044, 2012.
  * Suwała et al. (2024) Adrian Suwała, Bartosz Wójcik, Magdalena Proszewska, Jacek Tabor, Przemysław Spurek, and Marek Śmieja.  Face identity-aware disentanglement in stylegan.  In _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision_ , pages 5222–5231, 2024.
  * Sweeney (2000) Latanya Sweeney.  Simple demographics often identify people uniquely.  _Health (San Francisco)_ , 671:1–34, 2000.
  * Sweeney (2002) Latanya Sweeney.  k-anonymity: A model for protecting privacy.  _International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems_ , 10(05):557–570, 2002.
  * Taigman et al. (2014) Yaniv Taigman, Ming Yang, Marc’Aurelio Ranzato, and Lior Wolf.  Deepface: Closing the gap to human-level performance in face verification.  _2014 IEEE Conference on Computer Vision and Pattern Recognition_ , pages 1701–1708, 2014.  URL https://api.semanticscholar.org/CorpusID:2814088.
  * Tashiro et al. (2020) Yusuke Tashiro, Yang Song, and Stefano Ermon.  Diversity can be transferred: Output diversification for white-and black-box attacks.  _Advances in neural information processing systems_ , 33:4536–4548, 2020.
  * Tian et al. (2022) Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu.  A comprehensive survey on poisoning attacks and countermeasures in machine learning.  _ACM Computing Surveys_ , 55(8):1–35, 2022.
  * Tishby and Zaslavsky (2015) Naftali Tishby and Noga Zaslavsky.  Deep learning and the information bottleneck principle.  In _IEEE Information Theory Workshop (ITW)_ , pages 1–5. IEEE, 2015\.
  * Tishby et al. (2000) Naftali Tishby, Fernando C Pereira, and William Bialek.  The information bottleneck method.  In _IEEE Allerton_ , 2000.
  * Tolstikhin et al. (2018) I Tolstikhin, O Bousquet, S Gelly, and B Schölkopf.  Wasserstein auto-encoders.  In _International Conference on Learning Representations (ICLR)_ , 2018.
  * Tramèr et al. (2016) Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart.  Stealing machine learning models via prediction $\\{$APIs$\\}$.  In _25th USENIX security symposium (USENIX Security 16)_ , pages 601–618, 2016.
  * Tran et al. (2017) Luan Tran, Xi Yin, and Xiaoming Liu.  Disentangled representation learning gan for pose-invariant face recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 1415–1424, 2017.
  * Tripathy et al. (2019) Ardhendu Tripathy, Ye Wang, and Prakash Ishwar.  Privacy-preserving adversarial networks.  In _57th Annual Allerton Conference on Communication, Control, and Computing_ , pages 495–505. IEEE, 2019.
  * Uludag et al. (2004) Umut Uludag, Sharath Pankanti, Salil Prabhakar, and Anil K Jain.  Biometric cryptosystems: issues and challenges.  _Proceedings of the IEEE_ , 92(6):948–960, 2004\.
  * Vaswani et al. (2023) Kapil Vaswani, Stavros Volos, Cédric Fournet, Antonio Nino Diaz, Ken Gordon, Balaji Vembu, Sam Webster, David Chisnall, Saurabh Kulkarni, Graham Cunningham, et al.  Confidential computing within an $\\{$AI$\\}$ accelerator.  In _2023 USENIX Annual Technical Conference (USENIX ATC 23)_ , pages 501–518, 2023.
  * Vera et al. (2018) Matias Vera, Leonardo Rey Vega, and Pablo Piantanida.  Collaborative information bottleneck.  _IEEE Transactions on Information Theory_ , 65(2):787–815, 2018.
  * Villani (2008) Cédric Villani.  _Optimal transport: old and new_ , volume 338.  Springer Science & Business Media, 2008.
  * Voloshynovskiy et al. (2019) Slava Voloshynovskiy, Mouad Kondah, Shideh Rezaeifar, Olga Taran, Taras Holotyak, and Danilo Jimenez Rezende.  Information bottleneck through variational glasses.  In _4th Workshop on Bayesian Deep Learning (NeurIPS 2019)_ , 2019\.
  * Voloshynovskiy et al. (2001) Sviatoslav Voloshynovskiy, Shelby Pereira, Victor Iquise, and Thierry Pun.  Attack modelling: towards a second generation watermarking benchmark.  _Signal processing_ , 81(6):1177–1214, 2001.
  * Voloshynovskiy et al. (2000) Sviatoslav V Voloshynovskiy, Shelby Pereira, Alexander Herrigel, Nazanin Baumgartner, and Thierry Pun.  Generalized watermarking attack based on watermark estimation and perceptual remodulation.  In _Security and Watermarking of Multimedia Contents II_ , volume 3971, pages 358–370. SPIE, 2000.
  * Wagner and Eckhoff (2018) Isabel Wagner and David Eckhoff.  Technical privacy metrics: a systematic survey.  _ACM Computing Surveys (CSUR)_ , 51(3):1–38, 2018\.
  * Wang and Gong (2018) Binghui Wang and Neil Zhenqiang Gong.  Stealing hyperparameters in machine learning.  In _2018 IEEE symposium on security and privacy (SP)_ , pages 36–52. IEEE, 2018.
  * Wang et al. (2018) Hao Wang, Yitong Wang, Zheng Zhou, Xing Ji, Dihong Gong, Jingchao Zhou, Zhifeng Li, and Wei Liu.  Cosface: Large margin cosine loss for deep face recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 5265–5274, 2018.
  * Wang et al. (2019) Jingguo Wang, Zhe Shan, Manish Gupta, and H Raghav Rao.  A longitudinal study of unauthorized access attempts on information systems: The role of opportunity contexts.  _MIS Quarterly_ , 43(2):601–622, 2019.
  * Wang et al. (2022) Zhibo Wang, Jingjing Ma, Xue Wang, Jiahui Hu, Zhan Qin, and Kui Ren.  Threats to training: A survey of poisoning attacks and defenses on machine learning systems.  _ACM Computing Surveys_ , 55(7):1–36, 2022.
  * Wei et al. (2020) Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor.  Federated learning with differential privacy: Algorithms and performance analysis.  _IEEE Transactions on Information Forensics and Security_ , 15:3454–3469, 2020.
  * Winn (2007) Peter A Winn.  The guilty eye: Unauthorized access, trespass and privacy.  _The Business Lawyer_ , pages 1395–1437, 2007.
  * Wu et al. (2019) Tailin Wu, Ian Fischer, Isaac L Chuang, and Max Tegmark.  Learnability for the information bottleneck.  _International Conference on Learning Representations (ICLR)_ , 2019\.
  * Wyner (1975) Aaron D Wyner.  The wire-tap channel.  _Bell system technical journal_ , 54(8):1355–1387, 1975.
  * Xiao and Khisti (2019) Tianrui Xiao and Ashish Khisti.  Maximal information leakage based privacy preserving data disclosure mechanisms.  In _16th Canadian Workshop on Information Theory (CWIT)_ , pages 1–6. IEEE, 2019.
  * Xiao and Xiong (2015) Yonghui Xiao and Li Xiong.  Protecting locations with differential privacy under temporal correlations.  In _Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security_ , pages 1298–1309, 2015.
  * Yamamoto (1983) Hirosuke Yamamoto.  A source coding problem for sources with additional outputs to keep secret from the receiver or wiretappers (corresp.).  _IEEE Transactions on Information Theory_ , 29(6):918–923, 1983.
  * Yang et al. (2023) Haomiao Yang, Kunlan Xiang, Hongwei Li, and Rongxing Lu.  A comprehensive overview of backdoor attacks in large language models within communication networks.  _arXiv preprint arXiv:2308.14367_ , 2023.
  * Yao (1982) Andrew C Yao.  Protocols for secure computations.  In _23rd annual symposium on foundations of computer science (sfcs 1982)_ , pages 160–164. IEEE, 1982.
  * Ye et al. (2021) Mang Ye, Jianbing Shen, Gaojie Lin, Tao Xiang, Ling Shao, and Steven CH Hoi.  Deep learning for person re-identification: A survey and outlook.  _IEEE transactions on pattern analysis and machine intelligence_ , 44(6):2872–2893, 2021.
  * Yeung (1991) Raymond W Yeung.  A new outlook on shannon’s information measures.  _IEEE Transactions on Information Theory_ , 37(3):466–474, 1991.
  * Zaidi et al. (2020) Abdellatif Zaidi, Iñaki Estella-Aguerri, et al.  On the information bottleneck problems: Models, connections, applications and information theoretic views.  _Entropy_ , 22(2):151, 2020.
  * Zamani et al. (2023) Amirreza Zamani, Tobias J Oechtering, and Mikael Skoglund.  On the privacy-utility trade-off with and without direct access to the private data.  _IEEE Transactions on Information Theory_ , 2023.
  * Zarrabian et al. (2023) Mohammad Amin Zarrabian, Ni Ding, and Parastoo Sadeghi.  On the lift, related privacy measures, and applications to privacy–utility trade-offs.  _Entropy_ , 25(4):679, 2023.
  * Zhang et al. (2021) Ziqi Zhang, Chao Yan, Thomas A Lasko, Jimeng Sun, and Bradley A Malin.  Synteg: a framework for temporal structured electronic health data simulation.  _Journal of the American Medical Informatics Association_ , 28(3):596–604, 2021.
  * Zheng et al. (2015) Liang Zheng, Liyue Shen, Lu Tian, Shengjin Wang, Jingdong Wang, and Qi Tian.  Scalable person re-identification: A benchmark.  In _Proceedings of the IEEE international conference on computer vision_ , pages 1116–1124, 2015.
  * Zheng et al. (2016) Liang Zheng, Yi Yang, and Alexander G Hauptmann.  Person re-identification: Past, present and future.  _arXiv preprint arXiv:1610.02984_ , 2016.
  * Zhu et al. (2021) Zheng Zhu, Guan Huang, Jiankang Deng, Yun Ye, Junjie Huang, Xinze Chen, Jiagang Zhu, Tian Yang, Jiwen Lu, Dalong Du, et al.  Webface260m: A benchmark unveiling the power of million-scale deep face recognition.  In _IEEE/CVF CVPR_ , 2021.

##  A Connecting the Privacy Funnel Method with Other Models

###  A.1 Connection with Information Bottleneck Model

In contrast to the Privacy Funnel (PF) model, which aims to obtain a
representation $\mathbf{Z}$ that minimizes information leakage about
$\mathbf{S}$ while maximizing information utility about $\mathbf{X}$, the
Information Bottleneck (IB) model (Tishby et al., 2000) focuses on extracting
relevant information from the random variable $\mathbf{X}$ about an associated
random variable $\mathbf{U}$ of interest. Given two correlated random
variables $\mathbf{U}$ and $\mathbf{X}$ with a joint distribution
$P_{\mathbf{U,X}}$, the objective of the original IB model is to find a
representation $\mathbf{Z}$ of $\mathbf{X}$ through a stochastic mapping
$P_{\mathbf{Z}\mid\mathbf{X}}$ that satisfies: (i)
$\mathbf{U}\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{X}\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{Z}$,
and (ii) representation $\mathbf{Z}$ is maximally informative about
$\mathbf{U}$ (maximizing $\mathrm{I}\left(\mathbf{U};\mathbf{Z}\right)$) while
being minimally informative about $\mathbf{X}$ (minimizing
$\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)$). This trade-off can be
expressed by the bottleneck functional:

$\displaystyle\mathsf{IB}\left(R^{\mathrm{u}},P_{\mathbf{U},\mathbf{X}}\right)\coloneqq\mathop{\inf}_{\begin{subarray}{c}P_{\mathbf{Z}\mid\mathbf{X}}:\\\
\mathbf{U}\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{X}\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{Z}\end{subarray}}\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)\;\;\mathrm{s.t.}\;\;\mathrm{I}\left(\mathbf{U};\mathbf{Z}\right)\geq
R^{\mathrm{u}}.$ (39)

In the IB model, $\mathrm{I}\left(\mathbf{U};\mathbf{Z}\right)$ is referred to
as the relevance of $\mathbf{Z}$, and
$\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)$ is called the complexity of
$\mathbf{Z}$. Since mutual information is defined as Shannon information, the
complexity here is quantified by the minimum description length of compressed
representation $\mathbf{Z}$. The IB curve is defined by the values
$\mathsf{IB}\left(R,P_{\mathbf{U},\mathbf{X}}\right)$ for different $R$.
Similarly, by introducing a Lagrange multiplier $\beta\geq 0$, the IB problem
can be represented by the associated Lagrangian functional:

$\mathcal{L}_{\mathrm{IB}}\left(P_{\mathbf{Z}\mid\mathbf{X}},\beta\right)\coloneqq\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)-\beta\,\mathrm{I}\left(\mathbf{U};\mathbf{Z}\right).$
(40)

The formulation of the IB method in (Tishby et al., 2000) has inspired
numerous characterizations, generalizations, and applications (Makhdoumi et
al., 2014; Tishby and Zaslavsky, 2015; Alemi et al., 2016; Strouse and Schwab,
2017; Vera et al., 2018; Kolchinsky et al., 2019; Bang et al., 2019; Amjad and
Geiger, 2019; Hu et al., 2019; Wu et al., 2019; Fischer, 2020; Federici et
al., 2020; Ding and Sadeghi, 2019; Hafez-Kolahi and Kasaei, 2019; Hafez-Kolahi
et al., 2020; Kirsch et al., 2020). For a review of recent research on IB
models, we refer the reader to (Voloshynovskiy et al., 2019; Goldfeld and
Polyanskiy, 2020; Zaidi et al., 2020; Asoodeh and Calmon, 2020; Razeghi et
al., 2023).

###  A.2 Connection with Complexity-Leakage-Utility Bottleneck Model

Given three dependent (correlated) random variables $\mathbf{U}$, $\mathbf{S}$
and $\mathbf{X}$ with joint distribution $P_{\mathbf{U,S,X}}\,$, the goal of
the CLUB model (Razeghi et al., 2023) is to find a representation $\mathbf{Z}$
of $\mathbf{X}$ using a stochastic mapping $P_{\mathbf{Z}\mid\mathbf{X}}$ such
that: (i)
$\left(\mathbf{U},\mathbf{S}\right)\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{X}\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{Z}$,
and (ii) representation $\mathbf{Z}$ is maximally informative about
$\mathbf{U}$ (maximizing $\mathrm{I}\left(\mathbf{U};\mathbf{Z}\right)$) (iii)
while being minimally informative about $\mathbf{X}$ (minimizing
$\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)$) and (iv) minimally informative
about $\mathbf{S}$ (minimizing
$\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)$). We can formulate this three-
dimensional trade-off by imposing constraints on the two of them. That is, for
a given information complexity and information leakage constraints,
$R^{\mathrm{z}}\geq 0$ and $R^{\mathrm{s}}\geq 0$, respectively, this trade-
off can be formulated by a CLUB functional:

$\displaystyle\mathsf{CLUB}\left(R^{\mathrm{z}},R^{\mathrm{s}},P_{\mathbf{U},\mathbf{S},\mathbf{X}}\right)\coloneqq\mathop{\sup}_{\begin{subarray}{c}P_{\mathbf{Z}\mid\mathbf{X}}:\\\
\left(\mathbf{U},\mathbf{S}\right)\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{X}\hbox{$\\--$}\kern-1.5pt\hbox{$\circ$}\kern-1.5pt\hbox{$\\--$}\mathbf{Z}\end{subarray}}\mathrm{I}\left(\mathbf{U};\mathbf{Z}\right)\;\quad\;\mathrm{s.t.}\quad\mathrm{I}\left(\mathbf{X};\mathbf{Z}\right)\leq
R^{\mathrm{z}},\;\;\mathrm{I}\left(\mathbf{S};\mathbf{Z}\right)\leq
R^{\mathrm{s}}.$ (41)

Setting $\mathbf{U}\equiv\mathbf{X}$ and
$R^{\mathrm{z}}\geq\mathrm{H}\left(P_{\mathbf{X}}\right)$ in the CLUB
objective (41), the CLUB model reduces to the discriminative (classical) PF
model (7).

###  A.3 Connection with Image-to-Image Transition Models

Consider two measurable spaces $\mathcal{X}$ and $\mathcal{Y}$. Let
$\mathbf{X}\sim P_{\mathbf{X}}$ and $\mathbf{Y}\sim P_{\mathbf{Y}}$ be random
objects representing random realizations from these spaces, with distributions
$P_{\mathbf{X}}$ and $P_{\mathbf{Y}}$ respectively, where
$\mathbf{X}\in\mathcal{X}$ and $\mathbf{Y}\in\mathcal{Y}$. Let
$f:\mathcal{X}\rightarrow\mathcal{Y}$ and
$g:\mathcal{Y}\rightarrow\mathcal{X}$ denote appropriate mappings (or
functions) that map elements between these spaces.

The objective of the image-to-image translation problem is to find (learn) a
mapping $f:\mathcal{X}\rightarrow\mathcal{Y}$ (or vice versa
$g:\mathcal{Y}\rightarrow\mathcal{X}$) such that (i) the distribution of the
mapped object approximates the distribution of the target object, i.e.,
$P_{f\left(\mathbf{X}\right)}\approx P_{\mathbf{Y}}$ and/or
$P_{\mathbf{X}}\approx P_{g\left(\mathbf{Y}\right)}$; and (ii) the mapping
preserves or captures specific characteristics or features of the input
images. This can be formally expressed as a constraint optimization problem,
where the mapped images maintain certain predefined properties or metrics of
similarity with the input images. This is a fundamental aspect of tasks like
style transfer, domain adaptation, or generative modeling.

Let
$\mathcal{C}_{\mathsf{U}}\big{(}P_{f\left(\mathbf{X}\right),\mathbf{Y}}\big{)}=\mathsf{dist}\left(P_{f\left(\mathbf{X}\right)},P_{\mathbf{Y}}\right)$,
where $\mathsf{dist}\left(P_{f\left(\mathbf{X}\right)},P_{\mathbf{Y}}\right)$
is a discrepancy measure between $P_{f\left(\mathbf{X}\right)}$ and
$P_{\mathbf{Y}}$. For instance, one can consider
$\mathsf{dist}(P_{f\left(\mathbf{X}\right)},P_{\mathbf{Y}})=\mathrm{D}_{\mathsf{f}}(P_{f\left(\mathbf{X}\right)}\|P_{\mathbf{Y}})$,
or alternatively, one can use the Maximum Mean Discrepancy (MMD) for a
characteristic positive-definite reproducing kernel (Tolstikhin et al., 2018).
Now, we can consider an optimization problem where the objective is to
minimize a loss function that quantifies both the distributional similarity
and the preservation of image characteristics:

$\displaystyle\mathop{\min}_{f,g}\;\;\;\mathsf{dist}\left(P_{f\left(\mathbf{X}\right)},P_{\mathbf{Y}}\right)+\mathsf{dist}(P_{g\left(\mathbf{Y}\right)},P_{\mathbf{X}})+\lambda_{x}\Phi_{x}(\mathbf{X},f\left(\mathbf{X}\right))+\lambda_{y}\Phi_{y}(\mathbf{Y},g\left(\mathbf{Y}\right)).$
(42)

We can leverage image-to-image transition models from this perspective within
a domain-preserving privacy funnel method. This method diverges from
traditional obfuscation techniques for the sensitive attribute $\mathbf{S}$.
Instead, it involves deliberate manipulation of image attributes in a random
manner. The defender generates and releases a manipulated image achieved by
uniformly selecting a random attribute from the set of events pertinent to
$\mathbf{S}$.

##  B Estimation of Mutual Information via MINE

The Mutual Information Neural Estimation (MINE) (Belghazi et al., 2018) method
employs the Donsker-Varadhan representation of the Kullback-Leibler divergence
for estimating mutual information between variables. This approach is
particularly effective in high-dimensional spaces where traditional methods
fall short. The Donsker-Varadhan representation of KL divergence
$\mathrm{D}_{\mathrm{KL}}(P\|Q)$ between two probability distributions $P$ and
$Q$ is defined as follows.

######  Theorem 4 (Donsker-Varadhan Representation)

The KL divergence admits the dual representation (Donsker and Varadhan, 1983):

$\mathrm{D}_{\mathrm{KL}}(P\|Q)=\sup_{T\in\mathcal{T}}\mathbb{E}_{P}[T]-\log(\mathbb{E}_{Q}[e^{T}]),$
(43)

where $\mathcal{T}$ is a class of measurable functions for which the
expectations are finite.

Mutual information $\mathrm{I}(\mathbf{X};\mathbf{Y})$ between random objects
$\mathbf{X}$ and $\mathbf{Y}$ is defined using the KL divergence
$\mathrm{I}(\mathbf{X};\mathbf{Y})=\mathrm{D}_{\mathrm{KL}}(P_{\mathbf{XY}}\|P_{\mathbf{X}}P_{\mathbf{Y}})$.
In the MINE framework, we utilize a neural network parameterized by
$\bm{\theta}_{\mathsf{MINE}}$888We use subscript $\mathsf{MINE}$ to
distinguish it from our parameterized utility decoder $\bm{\theta}$ utilized
in our deep variational privacy funnel model., denoted as
$T_{\bm{\theta}_{\mathsf{MINE}}}$, to approximate functions in $\mathcal{T}$.
The estimated mutual information
$\widehat{\mathrm{I}}_{\bm{\theta}_{\mathsf{MINE}}}(\mathbf{X};\mathbf{Y})$ is
given by:

$\widehat{I}_{\bm{\theta}_{\mathsf{MINE}}}(\mathbf{X};\mathbf{Y})=\sup_{\bm{\theta}_{\mathsf{MINE}}\,\in\,\bm{\Theta}}\mathbb{E}_{P_{\mathbf{XY}}}[T_{\bm{\theta}_{\mathsf{MINE}}}]-\log(\mathbb{E}_{P_{\mathbf{X}}P_{\mathbf{Y}}}[e^{T_{\bm{\theta}_{\mathsf{MINE}}}}]),$
(44)

where $P_{\mathbf{XY}}$ is the joint distribution of $\mathbf{X}$ and
$\mathbf{Y}$, and $P_{\mathbf{X}}P_{\mathbf{Y}}$ is the product of their
marginal distributions.

The neural network is trained by maximizing
$\widehat{\mathrm{I}}_{\bm{\theta}_{\mathsf{MINE}}}(\mathbf{X};\mathbf{Y})$
using stochastic gradient descent. This process involves sampling from
$P_{\mathbf{XY}}$ and $P_{\mathbf{X}}P_{\mathbf{Y}}$, and iteratively updating
$\bm{\theta}_{\mathsf{MINE}}$ to enhance the estimated MI. While MINE is a
robust estimator for MI, its performance depends on several factors including
the architecture of the neural network, the optimization strategy, and the
choice of hyperparameters. The complexity of the network and the convergence
of the optimization process are critical to achieving accurate estimations of
MI.

In our study, we implemented an enhanced version of the MINE method using
PyTorch, focusing on significant improvements for practical use. Key
optimizations include a more organized and readable code structure, a modular
design for easy modification, advanced techniques for neural network
initialization, and an improved sampling mechanism. Additionally, the
implementation features an adaptive learning rate scheduler and a customizable
optimizer, catering to diverse research needs and improving overall
performance and convergence of the method. The PyTorch Pseudo-Code of
algorithm is given in Algorithms 3.

Algorithm 3 PyTorch Pseudo-Code Algorithm for Mutual Information Neural
Estimation

1:dim_x, dim_y, moving_average_rate, hidden_size, network_type, batch_size,
n_iterations, n_verbose, n_window, save_progress

2:Estimated Mutual Information (MI) between two datasets

3:Initialize the neural network (MLP or CNN) based on network_type and
hidden_size

4:Apply Xavier initialization to the network’s weights and biases

5:Class MINE:

6: Define the MINE model with the initialized network

7: Initialize moving_average_exp_t as 1.0

8:function ForwardPass(x, y)

9: Concatenate input tensors x and y

10: Pass the concatenated input through the network

11: return the output of the network

12:end function

13:function TrainMINE(dataset)

14: Set the MINE model to training mode

15: Initialize the optimizer (Adam or RMSprop) with learning_rate

16: Initialize the learning rate scheduler

17: Create an array to store MI estimates for n_window iterations

18: Optionally, initialize a tensor to save MI progress

19: for iteration = 1 to n_iterations do

20: Sample joint and marginal batches (x, y, y_tilde) from dataset

21: Forward pass with joint and marginal samples to compute t and exp_t

22: Calculate the loss as the negative lower bound of MI

23: Perform backpropagation and update the model parameters using the
optimizer

24: Update the learning rate scheduler

25: Store the current MI estimate

26: if iteration % n_verbose == 0 then

27: Print the average MI over the last n_window iterations

28: end if

29: if save_progress > 0 and iteration % save_progress == 0 then

30: Save the current MI estimate to mi_progress

31: end if

32: end for

33: return the average MI over the last n_window iterations or the mean of
mi_progress

34:end function

35:function EvaluateMI(x, y)

36: Split x and y into batches