# Learning Privacy Preserving Encodings through Adversarial Training

arXiv: https://arxiv.org/abs/1802.05214 · HTML: https://mlsanity.com/paper/1802.05214/

## Key facts

- Cited by 30 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Feb 2018.

## Built on by (most cited first, 30 of 30)

- [How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy](https://mlsanity.com/paper/2303.00654/) (2023)
- [SPAct: Self-supervised Privacy Preservation for Action Recognition](https://mlsanity.com/paper/2203.15205/) (2022)
- [NinjaDesc: Content-Concealing Visual Descriptors via Adversarial Learning](https://mlsanity.com/paper/2112.12785/) (2021)
- [To image, or not to image: Class-specific diffractive cameras with all-optical erasure of undesired objects](https://mlsanity.com/paper/2205.13122/) (2022)
- [PrivHAR: Recognizing Human Actions From Privacy-preserving Lens](https://mlsanity.com/paper/2206.03891/) (2022)
- [Generative Adversarial Networks: A Survey Towards Private and Secure Applications](https://mlsanity.com/paper/2106.03785/) (2021)
- [Data synthesis and adversarial networks: A review and meta-analysis in cancer imaging](https://mlsanity.com/paper/2107.09543/) (2021)
- [Privacy-Preserving Action Recognition via Motion Difference Quantization](https://mlsanity.com/paper/2208.02459/) (2022)
- [Defenses in Adversarial Machine Learning: A Survey](https://mlsanity.com/paper/2312.08890/) (2023)
- [Analysis and Mitigations of Reverse Engineering Attacks on Local Feature Descriptors](https://mlsanity.com/paper/2105.03812/) (2021)
- [LDP-Feat: Image Features with Local Differential Privacy](https://mlsanity.com/paper/2308.11223/) (2023)
- [PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks](https://mlsanity.com/paper/2307.10981/) (2023)
- [Uncertainty-Autoencoder-Based Privacy and Utility Preserving Data Type Conscious Transformation](https://mlsanity.com/paper/2205.01950/) (2022)
- [Learning Human Action Recognition Representations Without Real Humans](https://mlsanity.com/paper/2311.06231/) (2023)
- [Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directions](https://mlsanity.com/paper/2209.04022/) (2022)
- [PrivateGaze: Preserving User Privacy in Black-box Mobile Gaze Tracking Services](https://mlsanity.com/paper/2408.00950/) (2024)
- [Privacy-Enhancing Optical Embeddings for Lensless Classification](https://mlsanity.com/paper/2211.12864/) (2022)
- [Activity Recognition on Avatar-Anonymized Datasets with Masked Differential Privacy](https://mlsanity.com/paper/2410.17098/) (2024)
- [Learning Robust and Privacy-Preserving Representations via Information Theory](https://mlsanity.com/paper/2412.11066/) (2024)
- [Video-DPRP: A Differentially Private Approach for Visual Privacy-Preserving Video Human Activity Recognition](https://mlsanity.com/paper/2503.02132/) (2025)
- [StyleGAN as a Utility-Preserving Face De-identification Method](https://mlsanity.com/paper/2212.02611/) (2022)
- [Initial Exploration of Zero-Shot Privacy Utility Tradeoffs in Tabular Data Using GPT-4](https://mlsanity.com/paper/2404.05047/) (2024)
- [Privacy Safe Representation Learning via Frequency Filtering Encoder](https://mlsanity.com/paper/2208.02482/) (2022)
- [Depth-Guided Privacy-Preserving Visual Localization Using 3D Sphere Clouds](https://mlsanity.com/paper/2605.00562/) (2026)
- [Fair mapping](https://mlsanity.com/paper/2209.00617/) (2022)
- [Schr"odinger's Camera: First Steps Towards a Quantum-Based Privacy Preserving Camera](https://mlsanity.com/paper/2303.07510/) (2023)
- [Optimizing Privacy and Utility Tradeoffs for Group Interests Through Harmonization](https://mlsanity.com/paper/2404.05043/) (2024)
- [Revealing Unintentional Information Leakage in Low-Dimensional Facial Portrait Representations](https://mlsanity.com/paper/2503.09306/) (2025)
- [Learning Private Representations through Entropy-based Adversarial Training](https://mlsanity.com/paper/2507.10194/) (2025)
- [Revisiting Geometric Obfuscation with Dual Convergent Lines for Privacy-Preserving Image Queries in Visual Localization](https://mlsanity.com/paper/2604.22310/) (2026)

## Abstract (arXiv)

We present a framework to learn privacy-preserving encodings of images that inhibit inference of chosen private attributes, while allowing recovery of other desirable information. Rather than simply inhibiting a given fixed pre-trained estimator, our goal is that an estimator be unable to learn to accurately predict the private attributes even with knowledge of the encoding function. We use a natural adversarial optimization-based formulation for this---training the encoding function against a classifier for the private attribute, with both modeled as deep neural networks. The key contribution of our work is a stable and convergent optimization approach that is successful at learning an encoder with our desired properties---maintaining utility while inhibiting inference of private attributes, not just within the adversarial optimization, but also by classifiers that are trained after the encoder is fixed. We adopt a rigorous experimental protocol for verification wherein classifiers are trained exhaustively till saturation on the fixed encoders. We evaluate our approach on tasks of real-world complexity---learning high-dimensional encodings that inhibit detection of different scene categories---and find that it yields encoders that are resilient at maintaining privacy.