{'fraction_non_alphanumeric': 0.029910092440167152, 'fraction_numerical': 0.006914017981511967, 'mean_word_length': 4.527155655095185, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Protecting Sensitive Attributes via Generative Adversarial Networks

Recent advances in computing have allowed for the possibility to collect large amounts of data on personal activities and private living spaces. Collecting and publishing a dataset in this environment can cause concerns over privacy of the individuals in the dataset. In this paper we examine these privacy concerns. In particular, given a target application, how can we mask sensitive attributes in the data while preserving the utility of the data in that target application. Our focus is on protecting attributes that are hidden and can be inferred from the data by machine learning algorithms. We propose a generic framework that (1) removes the knowledge useful for inferring sensitive information, but (2) preserves the knowledge relevant to a given target application. We use deep neural networks and generative adversarial networks (GAN) to create privacy-preserving perturbations. Our noise-generating network is compact and efficient for running on mobile devices. Through extensive experiments, we show that our method outperforms conventional methods in effectively hiding the sensitive attributes while guaranteeing high performance for the target application. Our results hold for new neural network architectures, not seen before during training and are suitable for training new classifiers.


INTRODUCTION
In recent years, we have witnessed an explosive growth in the use of data-driven techniques in every aspect of our lives. Massive amounts of data are collected and processed, to predict consumers' behavior, to improve an airport's safety measures, or to make energy delivery to buildings more efficient. While we celebrate the convenience brought to us by these technologies, the collected data can often be personal information and contain attributes that could be extremely sensitive. With the recent breakthroughs in machine learning, datasets that look innocent can be used to reveal sensitive information. For example, one can infer the number of people talking, their identity and social relationships and the type of environment based solely on background noise [27][28][29][30]41]. Data from electricity meters can reveal sensitive information such as the average household incomes and the occupants' age distributions [42]. GPS trajectories can reveal social ties [12,39] and are very unique for each person [9]. Using WiFi scans, one can discover occupancy patterns of private households [19]. The collection and usage of such data raises important questions of ethics and privacy. It is thus crucial that we try to find the correct balance between using data to improve the quality of our lives while making sure sensitive information is effectively protected.
The most used notion of privacy has been Differential Privacy (DP) [10]. Consider a database in which each entry is a piece of sensitive data (e.g., a patient's medical history) which cannot be released, but aggregated queries on these entries are considered non-sensitive and allowed. More specifically, consider a database D 1 and a clone of it, D 2 , that lacks only one record u. If the answer to a query to the two databases are almost indistinguishable (with probability e ε ), there is a good chance we cannot infer whether u was in the database or not. This is termed ε-differential privacy. Despite DP's flexibility in providing a privacy guarantee in different applications, it can sometimes be too restrictive [2] and in some applications can hurt the utility of the data as a result [14].
There are other metrics for privacy, which are suited for wellstructured (e.g. relational) data, such as k-anonymity [37] among a multitude of others. These criteria attempt to offer guarantees about the ability of an attacker to easily recognize a certain record within a database. All of these techniques, however, rely heavily on a priori knowledge of which features in the data are either sensitive themselves or can be linked to sensitive attributes. In wellstructured data, such as a patient's medical record, we often have a clear idea of which attributes are sensitive, such as the patient's name, address or other personally identifying information. This is a key distinction from our work as we focus mainly on unstructured data, such as images or binary vectors, where sensitive attributes are not known beforehand and has to be automatically discovered and erased.
In this paper, we argue that in certain application scenarios, we are able to perform a more targeted privacy protection which takes into account the content of data. We notice that it is not enough to remove or perturb only the sensitive attributes to guarantee privacy, as sensitive information may be embedded in multiple attributes and may be learned through a classifier. We introduce a procedure called PR-GAN : the user may specify a function f (such as a classifier) that predicts target attributes and a function д that predicts sensitive attributes. We then perturb the input data in a way that f continues performing well while the performance of д is severely impaired. The function f describes data utility and function д characterizes the privacy concern.
Consider a case where volunteers want to contribute their photos to train a classifier for a given task such as gender identification, but they do not want their identities to be revealed in case the data ends up in the wrong hands. Since the organization that keeps the data may not be trusted to properly address the privacy concerns, a better approach is ensuring privacy from the source. Figure 1 shows such a case where Alice and Bob want to share their photos with an external server and they use perturbations to conceal their identity. An adversary, using an auxiliary dataset has trained an identity-revealing model. He then intercepts Bob's message midway Figure 1: Using our method (PR-GAN), Alice sends anonymized data (denoted by blurred faces) to a server outside, making sure her identity is not revealed but her gender is visible. When an adversary intercepts her message, he cannot de-anonymize her identity using a classifier. However, the adversary can reveal Bob's identity as he uses a naive noise generation method 1 . and reveals his identity using this model. Our goal is that if Alice's photo, perturbed by our method, is intercepted, the adversary won't succeed in revealing her identity. Keep in mind that in order for their photos to be useful, Alice and Bob both have to make sure that their photos have valuable utility to train a gender identification model.
To produce the tailored perturbation, we use Generative Adversarial Networks (GAN) [15]. A standard GAN is composed of two neural networks contesting with each other in a zero-sum game framework. More specifically, GAN simultaneously trains two models: a generative model G and a discriminative model D. G and D take turns in training, where G tries to maximize the probability of D making a mistake while D tries to predict whether an input data is fake (produced by G) as accurately as possible. After training, the generator G produces artificial data that looks indistinguishable from the original data by the discriminator D. GAN has achieved visually appealing results in image generation [3] with the quality of the synthesis improved by the year [18,45]. Although the training of the noise generator network (G) might be expensive, the network itself can be very compact and, as shown in Section 5.3, suitable for running on personal devices. One can first train it with as much computational resources as required, then deploy it to remote devices. Once there, it can be used to anonymize data from source. This procedure is depicted in Figure 2.
To test our method, we conduct extensive experiments with three datasets: (1) MNIST, a standard benchmark image dataset, (2) a WiFi signal dataset for indoor localization, and (3) PubFig, a dataset of faces. For each dataset we show compelling evidence of the performance of our perturbations, compared to baseline approaches. Our method is capable of finding a good trade-off in difficult situations where the sensitive and target attributes are highly correlated. Through experiments we demonstrate that although we plug in specific classifiers in our training, the perturbation works for new classifiers not seen before. The perturbed data can be used for inference purposes as well as training new models for target application with a high performance.
The key properties of our approach can be summarized below.
(1) We provide a new framework for application-driven private data-publishing which allows for elaborate user-specified constraints. The trade-off between privacy and utility is builtin in our proposed framework. This means that when sensitive and target attributes are correlated, our solution can easily allow users to find the right trade-off between privacy (in terms of removing sensitive information) and utility (in terms of preserving information on target attributes). Our proposed framework is fairly generic and as shown in our experiments applicable to different types of input data and user specifications. (2) We provide theoretical understandings of proposed PR-GAN under idealistic settings combined with experimental results under a variety of different data sets. (3) To generate noise, our model does not need the whole dataset to be present. Once trained, the generator can be deployed on individual devices and generate perturbations locally from source. Unlike prior works on data perturbation in a centralized setting, our method is computationally efficient and is capable of making perturbations on large datasets. (4) Our model does not transform the feature space to perturb the data. This means that our perturbed data can be used alongside the original data in target classification tasks with high utility.
We first survey prior work and then present our solution.

RELATED WORK
Privacy in Learning Algorithms A lot of work have focused on manipulating the existing training and inference algorithms to protect privacy of training data, for example, a differentially private training algorithm for deep neural networks in which noise is added Users share anonymized data with the server Generator is trained and deployed to the users to the gradient during each iteration [1,33,35], and a "teacherstudent" model using aggregated information instead of the original signals [31]. It is also proposed to train a classifier in the cloud, with multiple users uploading their perturbed data to a central node without ever revealing their original private data [20,25]. Privacy-Preserving Data Publishing A different approach to preserve privacy is making sure sensitive elements of the data is removed before publishing it, often called privacy-preserving data publishing (PPDP) [6]. A main line of work in this field focuses on transforming numerical data into a secondary feature space, such that certain statistical properties are preserved and data mining tasks can be done with minimal performance loss [8,24,26]. These methods guarantee data utility only on this secondary space. This means that a classifier trained on the perturbed data is not guaranteed to perform well on original data. This can be troublesome in a scenario where a classification model is trained on public, perturbed data and is going to be deployed on users' personal devices to perform a task locally on non-perturbed private user data. Our perturbed data can be used in conjunction with original data in specified target applications. In addition, some of the methods in this category rely on expensive computations which renders them infeasible on large datasets. Adversarial Learning In recent years GANs have been successfully used to produce adversarial examples that can fool a classifier to predict wrong classes [40]. Some have formulated the problem of privacy protection as producing adversarial examples for an identity-revealing classifier [5,17]. However, we demonstrate through experiments that the absence of our proposed function, f , that maintains the utility of the data, leads to a weaker utility guarantee for the published data. Similar efforts have been made in the fairness literature to make sure that certain attributes (e.g., gender, or race) in a dataset do not create unwanted bias that affects decision making systems [4,13]. There is a key distinction between our work and that of Edwards and Storkey [13] in how we train our model. To train their model on a face dataset, the authors give two sets of data to the network, where in the second set, the last name of the subjects is artificially placed on each image. By providing two sets of acceptable and unacceptable samples, they are letting the model know what a safeto-publish image looks like prior to training. In our method, the model relies only on the two classifiers, f and д, to learn how the published results should look like. It is also unclear whether f and д in their work will reach an optimal state given that they are trained from scratch together with the generative model.
Keep in mind that our approach builds on top of the existing literature on privacy-preserving learning algorithms. After using our method to remove sensitive information from a dataset, one can apply any of the existing privacy-preserving learning algorithms to further protect the privacy of users. Finally, although our model uses a classifier f to guarantee high utility for certain desired tasks, a GAN by nature produces artificial samples indistinguishable from real ones, which makes the published data potentially useful for applications not specified by f .

PROBLEM DEFINITION
Suppose that we have a dataset where the i-th entry is a vector x i ∈ R N coming from an unknown distribution P data , with a corresponding sensitive label y i P ∈ {0, 1} and a target label y i L ∈ {0, 1}. We also have two functions f : R N → {0, 1}, which predicts the sensitive labels and д : R N → {0, 1}, which predicts the target labels. Given a prediction error function E, the goal is then to produce a perturbed version of X , X ′ , such that the following is minimized: where ℓ is a suitable loss function and λ determines the trade-off between privacy and utility. As you can see, this definition can be trivially extended to any categorical or numerical y P and y L by choosing the correct loss function. The perturbed data, X ′ , is then released for public use.

PR-GAN DESIGN 4.1 Architecture
As approximations of f and д, we have two discriminative classifiers, D L and D P , denoted by target and sensitive classifier. We also use a GAN, with a generative model G in charge of producing the perturbed data, G(x) = X ′ , and a discriminative model D which distinguishes X ′ from X . P д represents the distribution of the generated data from G. Note that the model can be easily extended to accommodate multiple classifiers for both sensitive and target attributes. Both D L and D P are pre-trained classifiers plugged into our network. The advantage of using pre-trained classifiers, is that we can use classifiers with complex architectures, such as VGG16 for images [36], to guide the training of G and D. It will be extremely difficult to train such networks alongside G and D from scratch. The overall structure of the network is shown in Figure 3. The process starts by the generator G taking the original instance x as input and generating the perturbed version of the data, G(x). Then G(x) is fed to the discriminators D, D L and D P . D's goal is distinguishing real data from perturbed data. D(x) represents the probability that x comes from the original data P data rather than produced data P д . We can write its loss function as below: G has multiple objectives. For the trade-off between privacy and utility, we can rewrite (1) to: where ℓ is a suitable loss function (e.g: cross-entropy loss) and λ controls the relative trade-off between privacy and utility. G also wants to fool the GAN discriminator D in order to create perturbed data indistinguishable from the real data; the loss function for this will be: Finally, it has been shown that using regularization can stabilize GAN's training and also provides an additional lever to control the utility of the perturbed data by limiting the overall perturbation added to the data [18]. Here, we use a hinge loss: where c is the maximum distance allowed before any loss is occurred. Our full objective for G, using (3), (4) and (5), can be written as: where α and β control the relative importance of the three losses. At each iteration, we alternate between training D and G while D P and D L are previously trained and fixed in the network.
To fine-tune the model parameters, with a fixed utility threshold T in mind, we explore the parameter space to minimize Acc(D P ) while keeping Acc(D L ) above T . Similarly, given a fixed privacy budget B, we can maximize Acc(D L ) while keeping Acc(D P ) below B. Here, Acc(·) denotes the accuracy score.

Theoretical Analysis
4.2.1 GAN Optimality. In the original GAN design, the generator G defines a probability distribution P д as the distribution of samples generated by G. Under favorable assumptions, the distribution P д converges to a good estimator of P data -the distribution of training data [15]. In our case, as we introduce additional classifiers and gradients, we wish to understand how these classifiers, D P , D L , modify the optimal solution and the final distribution.
Since GAN takes an iterative approach, the discriminator D and the generator G are optimized alternatively. We follow the same assumption as in [15]: there is enough capacity and training time and the discriminator is allowed to reach its optimal given a fixed generator G.
Fixed G, Optimize D. Notice that the discriminator D in our design uses the same loss function as in the original GAN. So the following claim is still true. Lemma 4.1 (Optimal Discriminator [15]). For a fixed generator G, the optimal discriminator D is where P data (x) is the probability that x is from the data and P д (x) is the probability that x is from the generator G.
Fixed D, Optimize G. In the original GAN, the global minimum for the generator is achieved if and only if the generated distribution P д is the same as P data : P д (x) = P data (x). In our setting we show that the global minimum is achieved if the generator G is an area preserving flipping map h on P data , when such a map exists.
To explain what is an area preserving flipping map, we first consider the two classifiers D P and D L . Let's suppose D P and D L are binary classifiers for now. A piece of data falls in one of the following four categories: X 10 , X 11 , X 01 , X 00 , where X i j , i, j ∈ {0, 1}, contains the data items with label i under D P and label j under D L . If each data item in X i j is changed by G to a data item in category X i ′ j with i ′ = 1 − i, we will be able to completely fool D P and pass D L . • Flipping property: h maps each data item x ∈ X i j ⊆ Ω to an item x ′ ∈ X i ′ j , with i ′ = 1 − i, and • Area preserving property: ∀Y ⊆ Ω, π (Y ) = π (h −1 (Y )), where π is the probability measure on Ω. That is, the total probability measure of Y before and after the mapping h is the same.
Lemma 4.3. If G is such an area preserving flipping map on Ω with measure P data , the generator loss L G is minimized.
Proof. Consider Y ′ ⊆ Ω as the collection of output from G when the input Y ⊆ Ω is taken with the distribution P data , i.e., Y = G −1 (Y ′ ). By the area preserving property, we have P data (Y ′ ) = P data (Y ); also P д (Y ′ ) = P data (Y ) by definition. Thus P д (Y ′ ) = P data (Y ′ ) for any Y ′ ⊆ Ω.
This essentially ensures that the output x ′ = G(x), with x following the distribution P data , also follows the same distribution P data . Thus the total loss of the GAN is still minimized, if the discriminator D is the optimal discriminator D * G . Further, the flipping property ensures that for any input x, the manipulated output G(x) completely fails D P and passes D L . Thus the total loss corresponding to D P and D L is minimized as well. □ Now the natural question is, when can we find an area preserving flipping map on our data? We first start with a definition on D P and D L .  Proof. Clearly, if P data (X i j ) P data (X i ′ j ) for some i, j, then we cannot satisfy the flipping property and area preserving property simultaneously. On the other hand, when the total probability measures of X i j and X i ′ j are the same, there is an area preserving map h that maps X i j to X i ′ j . First, an area preserving map exists between any two distribution [32]. Now we define a distribution π 0 (x), which is proportional to P data (x) for x ∈ X 01 ∪ X 00 , and 0 otherwise. Similarly we define a distribution π 1 (x) which is proportional to P data (x) for x ∈ X 11 ∪ X 10 , and 0 otherwise. Now the area preserving map h from π 0 to π 1 is an area preserving flipping map with D P and D L . □ Therefore we can summarize that assuming sufficient capacity for the generator G and discriminator D with binary features, it is possible to find an area preserving flipping map with D P and D L and achieve balance. Theorem 4.6. When the sensitive classifier D P and the safe classifier D L are balanced, the global minimum of the generator G is achieved if G is an area preserving flipping map with respect to D P and D L .
An example when D P and D L are not balanced is in Figure 4. In this case, we have way more data samples in X 11 and X 00 than X 01 and X 10 . D P and D L are strongly correlated. When x has label i in D P , very likely it has label i for D L as well. It is nearly impossible to protect the sensitive features and reveal the target features at the same time. There is a trade-off between the two objectives -either the distribution P д is different from P data (hurting generalization of the model), or the privacy protection cannot be ideal. This tradeoff will be examined and evaluated in the next section. For any two distributions, the area preserving map is not unique. Thus, the area preserving flipping map when D P and D L are balanced is not unique either. Finding one is not trivial though -since we do not have P data . This is mainly what the neural network optimizer is trying to achieve.
When there are multiple target/sensitive classifiers, the conclusion above can be easily extended. A flipping map will now flip all labels of the sensitive classifiers and maintain the labels of target classifiers. When the classifiers are not binary, a flipping map will change a label to any other label in the sensitive classifier.

Utility and Privacy
Protection. In our architecture, two specific classifiers D P and D L are used. A natural question to ask is how much the generated data depends on these choices of classifiers. If the perturbed data fail д = D P with accuracy 1 − ε we give a bound on the accuracy for a different (unseen) classifier f , under reasonable conditions. Definition 4.7 (Total variation distance [7]). For two probability distributions P X and P X ′ on X, the total variation distance between them is defined by Informally, the total variation distance measures the largest change in probability over all events. For discrete probability distributions, the total variation distance is just the ℓ 1 distance between the vectors in the probability simplex representing the two distributions. The proof can be found in supplemental material. Theorem 4.8. Suppose that the original data x ∈ P dat a and generated data G(x) are from distributions with total variance distance less than β. Consider an instance x with ground truth label y under a classification task with two classifiers f (·) and д(·) each with accuracy ACC(·) ≥ 1 − ε. If the perturbed data successfully fools д, i.e., Pr[д(x) д(G(x))] ≥ 1 − δ , then the perturbed data also fools f : Proof. By the definition that x and G(x) are from distributions with bounded total variance, we have If д was used in the training of G(x) and one cannot infer sensitive labels with д, we now show that the accuracy for f on labeling x and G(x) differently.
as claimed.

□
Here we can use learner д(·) to denote the model used during training process, and f (·) the one that is unseen before. Intuitively, this result formalizes the observation that well-trained classifiers should possess close decision boundaries in high-probability regions. In such settings, the perturbation that misleads one sensitive classifier will be able to protect the hidden attributes against other sensitive classifiers with high probability. Although the total variance distance here measures the distance for distributions of original and perturbed data instead of the distance between two actual instances, it can characterize the data manifold dynamics and guarantee that the perturbation added to the data can protect the privacy for certain sensitive attributes against arbitrarily trained classifiers.
Basically, from Theorem 4.8, we can see that for a new sensitive classifier, the perturbed data will also have high probability to fail the classifier and protect privacy. Similarly, this holds for the target classifier as well. This will be further evaluated in the experiment section later.

Implementation Details
In order to minimize the dependencies between different components in our model, we slice a dataset into 3 parts equal in size and class proportions. We use the first slice, A, to train D L and D P . We then use the second slice, B, to train G and D while using the previously trained D P and D L . Finally, we use the last slice, C, for testing purposes. Each slice is further divided into training and testing parts, with a ratio of 4:1, denoted by Y train and Y test for a slice Y .
Note that our method is not dependent on any specific architecture for D P and D L , and any model supporting gradient updates can be used here. We are assuming full access to the prediction results of the pre-trained classifiers. Since the training of classifiers for sensitive and target attributes and also the generative network is done by the data contributor/publisher, and not adversaries, this assumption is valid. However, we are assuming that an adversary, using a separate dataset (which can be public), trains a classifier to retrieve sensitive information and then attack the published data. Our goal is to prevent such attacks, while showing utility preservation.

EXPERIMENTS 5.1 Datasets
Below, we go over the datasets we have used along with the sensitive and target attributes we have defined for each: (1) MNIST [23]: A dataset of handwritten letters, which includes 60,000 training and 10,000 test examples. For this dataset, we define target attributes as the parity (being odd or even) of the numbers and the sensitive attributes as whether or not a digit is greater than 5. Note that this is only a hypothetical application to showcase the strength of our method on a well-studied dataset.  WiFi access points (WAP) are recorded for 21,048 locations inside 3 different buildings. The buildings have a total of 13 floors. In addition, each instance has a coordinate, which we use to cluster locations on each floor into 8 groups. We define the sensitive attribute as the specific cluster a user was in, and the target attribute the floor on which the user was. This is inspired by a scenario where contributors of the data are willing to reveal their location up to a certain granularity. Although the signal strengths are numerical, we achieved better results by changing the signals into binary attributes indicating the presence or absence of signal from a WAP. For brevity we call this dataset the WiFi dataset from now on. The detailed architectures of classifiers for each task and each dataset is mentioned in provided in the supplemental materials.

Baseline
In our experiments, we compare our method against the following baselines: • Naive Generative Privacy (NGP): We have argued that by utilizing a GAN's structure, we can produce more realistic perturbed data similar to the original. This will in turn increase the utility of the resulting datasets. To test this hypothesis we create an alternative architecture by removing D. We expect this method to provide a lower privacy guarantee (higher Acc(D P )) given a fixed utility threshold. • Adversarial Privacy (AP): We believe that the existence of a target classifier (D L ) to guide the training of G is essential for a better utility guarantee, and so we compare our method to an alternative architecture where D L is removed. This is essentially formulating the problem of privacy protection as defending against an adversary model (in our case D P ). We expect this method to provide a lower privacy guarantee (higher Acc(D P )) given a fixed utility threshold. • Differential Privacy (DP): For real-valued vectors (image datasets), we use the Laplace Mechanism known to achieve ε-differential privacy, where independent noise is added to each pixel with the Laplacian distribution: Here, b is the scale parameter of the distribution and this method achieves 1/b-differential privacy [11]. For the WiFi dataset, where attributes are binary, we use a Randomized Response (RR) approach [11] where for each bit of information u ∈ {0, 1}, we report its true value with probability p or else reporting either 0 or 1 uniformly at random. Such a mechanism provides ln 1+p 1−p -differential privacy. We perform this perturbation mechanism for each of the 520 signals and report the result for each record.
Our method is denoted by PR-GAN throughout experiments.

Running on Mobile Devices
As discussed earlier, once trained, we can remove the trained generator (G) and deploy it on remote devices to produce perturbations for users from source. This has the advantage that users will not need to trust an external entity with the safety of their sensitive information. The complexity and efficiency of a neural network depends on many factors, but as is common practice [34], we measure it by counting the number of parameters in a network and the number of floating-point operations (FLOP). In Table 2, we compare the complexity of our networks with state-of-the-art networks designed specifically to run on mobile devices. As you can see, our generator networks are more compact and computationally inexpensive compared to the state-of-the-art, which indicates that it is possible to deploy and use them on mobile devices using currently available technologies.

Performance
To show that our method is capable of effectively concealing the sensitive attributes while preserving the information about target attributes, we compare our method against the baselines across 3 datasets with a fixed utility (Acc(D L )) threshold. We select a threshold of 0.95 for the two image datasets, PubFig and MNIST, and 0.75 for the WiFi dataset. As we will see later on, due to high correlation between the sensitive and target attributes in the WiFi dataset, it is harder to effectively conceal sensitive attributes while keeping the target attributes almost intact. We dive deeper into the trade-off between utility and privacy in a case study on the WiFi dataset in Section 5.5. Recall from Section 4.3 that the dataset is divided into 3 slices, the first used to train D L and D P , the second to train the networks G and D and the third used for testing. To tune the hyperparameters for neural networks, we further split the GAN's training data into two parts, with a ratio of 4:1 and preserving the class proportions, and use the smaller part as a validation set to keep Acc(D L ) above the fixed threshold. For the methods based on DP, the optimal value of ε is found by iterating over different values of ε from 0.01 to 10 and selecting the largest ε (corresponding to the smallest added noise) where Acc(D L ) is above the set threshold and report the resulting Acc(D P ).
The performance of the methods along with the performance of the classifier on sensitive attributes on the original, non-perturbed data is available in Table 1. First, note that the two methods that do not utilize the target attributes in producing perturbations (DP and AP) achieve results that are far less promising than the other two methods. Furthermore, as the objectives become more complicated moving from binary attributes (WiFi dataset) to image data (MNIST and PubFig), this gap between the two groups grow wider and wider. Finally, you can see that our method, taking advantage of

Utility vs. Privacy
Ideally, one looks to perturb the data in a way that a classifier on sensitive attributes fails completely (with accuracy close to that of a random classifier) while a classifier on target attributes continues to perform as before. However, in many cases where the two objectives are in conflict and the sensitive and target attributes are correlated, this might not be possible. In these cases, a good trade-off between privacy and utility is desirable. Here, we test our method against the baselines over different utility loss budgets (a maximum allowed drop in Acc(D L )) and compare the achieved privacy (drop in Acc(D P )).
The utility loss budget is chosen from the interval [0.03, 0.12], corresponding to Acc(D L ) ∈ [0.80, 0.89]. Since we optimize the hyperparameters over many settings for all methods, we were only able to carry out this experiment on the WiFi dataset with the resources available to us.
You can see the results in Figure 6 where the x-axis is the utility loss budget and y-axis is the achieved privacy. As you can see, for every budget, our method outperforms the others and as we increase the budget, the margin between our achieved privacy and the others grows larger. Also worth noting is that the methods that are not guided by a classifier on target attributes (DP and AP) have a lower privacy gain per budget compared to the other two (PR-GAN and NGP). The results show that in difficult conditions, our method is capable of achieving a higher privacy guarantee given the same utility drop budget.

Transferability
We now test whether our results transfer to new models with a different architecture. We take the perturbed datasets produced in Section 5.4, and use two neural networks with new architectures trained on the original training data to perform the target and sensitive classification tasks. We then compare the resulting accuracy values with those reported in Section 5.4. We expect the results to remain relatively the same. The 3 architectures used for every dataset is shown in the 3 tables in Appendix A.
On the target classification task, we prefer no drop in accuracy when we change the model's architecture. For sensitive attributes, we would like to see the new model performing worse than the original model or a random classifier 2 . We formally define a drop in utility and privacy incurred by substituting the model's architecture as: Privacy Drop = max Acc(M ′ ) − max Acc(M), Acc(RC) , 0 , (8) where M is the original model, M ′ the new model, RC a random classifier and Acc(·) the accuracy of each model in the corresponding classification task. Note that the goal here is that the result on one neural network transfers to another with minimal changes to either utility or privacy. You can see the 3 models' accuracy values and the average utility and privacy drops over two new architectures in Table 3. As you can see, the drops in privacy and utility incurred by a change in the network's architecture are extremely low. The highest drop in utility is equal to 1.79% while the highest drop in privacy is equal to 2.47% and in both image datasets there are no drops in our privacy guarantee for neither of new architectures, which is ideal. Note that in the case of MNIST sensitive attributes, although the two new architectures have a performance significantly higher than that of the original model, they are both below the random classifier performance threshold (50%). Since no one can guarantee a performance lower than that of a random classifier, this is ideal.
These results suggest that the effects of our perturbations are transferable to other neural networks with different architectures. Since an adversary can choose any model to attack our perturbations, it is important to design a method with utility guarantees which can be extended to other networks with arbitrary architectures. In previous sections we demonstrated that our published datasets can be used for inference tasks on target attributes with high utility guarantees. In another scenario, it is possible that individuals share their anonymized data, using our method to produce perturbations, with an external entity to contribute to the training of a new model. This model can in turn be deployed on the individuals' devices to perform classification tasks on their raw, private data. To see if we can provide the same level of utility in this scenario as we did in the inference tasks before, we train new models for the 3 datasets on the perturbed datasets produced in Section 5.4 and test them on original data. The results are available in Table 4. As you can see, there is little or no significant change in the accuracy of the 3 models, which indicates that our method is capable to provide a high utility guarantee for both inference purposes as well as training purposes. This experiment shows a key advantage of our method over previous works where the perturbed data is in a transformed featured space and unsuitable to train models that can be tested on the original data [8,24,26].

CONCLUSION AND FUTURE WORK
In this work, we have tried to bridge the gap between privacy preserving data publishing and deep generative models, a field that is on the rise and is used extensively in other areas such as adversarial learning. We showed that it is possible to use deep neural networks as clues for generating tailored perturbations. By choosing this approach, not only we can effectively protect sensitive information, but we can also maintain the information necessary for a given target application. Note that the goal here is to fool a classifiers on specific tasks and not human beings. The results might seem clearly distinguishable from a human's point of view, but a machine might be unable to tell the difference.
Our experiments showed that our method's clear advantage over conventional methods, it's capability in finding a good tradeoff between privacy and utility, it's utility for both training and inference tasks, and the ability to be utilized on mobile devices with limited computational resources.
Finally, as more improved generative models are proposed, we can easily plug them into our framework to achieve better results. We believe that there are many interesting avenues of research to continue this work, including utilizing different GAN architectures to perturb different types of data (e.g: time series or very high resolution images), or guiding the users on the data they are about to share with a trusted central unit, to help train models without revealing private and potentially sensitive information.

A GENERATOR ARCHITECTURE DETAILS
Here are detailed architectures used in our experiments. Model 1 is the original architecture used across all experiments. Models 2 and 3 are the additional architectures used in the transferability experiment.