Towards Robust and Privacy-preserving Text Representations
Summary
Written text reveals details about its author, such as gender, age and location. NLP models can use these traits as shortcuts. This hurts performance on texts by unseen authors or from new domains, and it lets sensitive information leak through shared hidden representations. Li, Baldwin and Cohn address both problems with adversarial training based on Ganin et al. (2016). Each protected attribute gets its own discriminator, which tries to predict that attribute from the representation. A gradient reversal layer then pushes the encoder to defeat these discriminators while still serving the main task.
The method is tested on two tasks:
- POS tagging: a bi-LSTM pre-trained on the Web English Treebank, trained on TrustPilot data, and also evaluated on a held-out AAVE corpus.
- Sentiment: 5-class rating prediction on TrustPilot reviews with a Kim (2014) CNN.
Adversarial training narrows tagging accuracy gaps between demographic groups and improves accuracy both in-domain and out-of-domain. It also makes private attributes harder to recover, while sentiment F1 stays essentially unchanged. Unlike differential privacy, the approach gives no formal guarantees, but it also costs no accuracy.
Key points
- Objective: a min–max loss with one cross-entropy adversarial term per protected attribute (λ = 10⁻³), implemented via gradient reversal. The code is released on GitHub (lrank/Robust_and_Privacy_preserving_Text_Representations).
- TrustPilot POS tagging (600 sentences, Google Universal POS tagset):
- The baseline shows a 1.5-point accuracy gap between AGE groups (O45 vs U35); ADV cuts it to 0.3.
- The SEX gap falls from 0.2 to 0.1.
- Group accuracies rise to about 92%.
- AAVE held-out evaluation: ADV improves accuracy on every domain:
- LYRICS: 73.7 → 80.5
- SUBTITLES: 81.4 → 85.8
- TWEETS: 59.9 → 65.4
- Macro-average: 71.7 → 77.0
- Sentiment data: TrustPilot reviews filtered to English with LANGID.PY (confidence > 0.9) and balanced to 10k reviews for each of 5 countries.
- Sentiment results:
- Location attack accuracy drops from 53.4% to 22.1% with ADV-LOC, close to the 20% majority baseline.
- Test F1 stays around 40% (40.1 baseline vs 40.2 for ADV-all).
Cited by
- Don't Take the Premise for Granted: Mitigating Artifacts in Natural Language Inference
- Adversarial Removal of Demographic Attributes from Text Data
- The Importance of Modeling Social Factors of Language: Theory and Practice
- Deduplicating Training Data Mitigates Privacy Risks in Language Models
- Debiasing Pre-trained Contextualised Embeddings
- Gender Bias in Machine Translation
- Predictive Biases in Natural Language Processing Models: A Conceptual Framework and Overview
- Mitigating Gender Bias in Natural Language Processing: Literature Review
Cite
@inproceedings{li2018robust,
title = {{Towards Robust and Privacy-preserving Text Representations}},
author = {Li, Yitong and Baldwin, Timothy and Cohn, Trevor},
booktitle = {Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)},
year = {2018},
doi = {10.18653/v1/p18-2005},
url = {https://doi.org/10.18653/v1/p18-2005}
}References
- users based on their hidden representation. That is, lower discriminator performance indicates that the representation conveys better privacy for individuals, and vice versa. find
- Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318. find
This page in Markdown → https://md.research.elamur.ai/free/en/papers/li-2018-robust-privacy-preserving-text-representations/