In domains with high stakes such as law, recruitment, and healthcare, learning models frequently rely on sensitive user data for inference, necessitating the complete set of features. This not only poses significant privacy risks for individuals but also demands substantial human effort from organizations to verify information accuracy. This paper asks whether it is necessary to use \emph{all} input features for accurate predictions at inference time. The paper demonstrates that, in a personalized setting, individuals may only need to disclose a small subset of their features without compromising decision-making accuracy. The paper also provides an efficient sequential algorithm to determine the appropriate attributes for each individual to provide. Evaluations across various learning tasks show that individuals can potentially report as little as 10\% of their information while maintaining the same accuracy level as a model that employs the full set of user information.
Paper
References (34)
Scroll for more · 22 remaining
Similar papers
Peer review
Summary
This paper questions the necessity of soliciting all user information at inference time, with an eye towards privacy-sensitive domains such as law, recruitment, and healthcare, where learning models typically require access to extensive and sensitive user data for accurate prediction. The authors propose in some settings, individuals might only need to provide a small subset of their information to obtain accurate predictions, thereby protecting their privacy and easing the burden on organizations verifying the accuracy of disclosed information. To that end, the authors introduce a framework for simultaneously considering model certainty and data minimization. Their setup includes considering subsets of features that individuals can disclose in order to receive comparable prediction quality while providing fewer features. The authors propose algorithms for choosing the appropriate subset and present theoretical justification and empirical findings. Initial evaluations reveal that individuals may only need to disclose about 10% of their information to achieve the same accuracy level as a model that uses all user information.
Strengths
The primary strength of this paper is that it thoughtfully addresses a neglected and high-impact research question. As the authors note, there is strong evidence that "most users would only need to reveal a small portion of their sensitive data to achieve accurate model predictions with either absolute certainty or high confidence." They include a strong motivating example in Section 2, Figure 1, to make it clear that it's possible that a label could be obtained without requesting all sensitive features. Similarly, they underscore the importance of this work by noting the real-world impacts on privacy and the burden of verifying the provided information. Other strengths: - This paper includes a thoughtful framework for studying this problem, quantifying the tradeoff between model certainty (though not model performance, as claimed) and privacy loss. - The proposed methods include an efficient algorithm for a joint Gaussian setting as well as a less efficient Bayesian modeling alternative - The experiments appear well-designed, including considering random subsets of "private" features using publicly available datasets
Weaknesses
The primary weakness of this work is the use of entropy as a proxy for model performance. While the authors state that initially that their goal is the "produce accurate or nearly accurate predictions during inference" using fewer features, the goalposts subtly shift to "accurately predict[ing] the **output of the model** using the smallest possible number of sensitive features." This shift motivates the use of prediction entropy, rather than predictive performance, as a metric for the impact of obtaining additional features. This is significant because while entropy obeys the "information never hurts" principle, predictive performance does not (see, e.g., https://proceedings.mlr.press/v97/ustun19a.html). Considering predictive performance (instead of entropy) likely makes this problem more difficult, and it's possible that using entropy is a reasonable proxy in some cases. However, this choice merits at minimum discussion and ideally theoretical and experimental justification. Other weaknesses: Unclear/imprecise notation and language: - "data leakage" is used inconsistently throughout the paper. It is introduced as "the percentage of sensitive features that are revealed unnecessarily, meaning that their exclusion would not significantly impact the model’s output," but the authors later state that "[increasing $\delta$ yields] reduced data leakage but also less precise model predictions" which appears contradictory. This term is later used as a metric in the experiments, but without a precise definition and with axes that seem to contradict prior use. - on line 155-156, the authors state that the imputation does not occur, and the "unrevealed features are treated as random variables and are integrated during the prediction process." This process is not further explained but appears to be implicit in Equation 5 with a Schur complement (and arguably as a form of imputation). - "public" is used both to describe a subset of features "public x_P and sensitive x_S features" and a subset of samples "trained on a public dataset" - The hyperparameter T appears on line 9 of Algorithm 1 but is not discussed from what I could tell, either theoretically or empirically - In line 13 of Algorithm 1, it is unclear if feature j* is actually obtained here or if it is added to the set of features to be obtained. I assume the former. - The assumption that the cost of obtaining each feature is uniform should be explicitly stated. Other: - The authors claim throughout the paper that they are the first to study this type of work (line 47, line 420) despite the presence of several other publications on this topic (e.g., https://arxiv.org/abs/1602.03600 or https://proceedings.mlr.press/v5/yu09a.html) - Some words were used improperly (e.g., "contrast" on line 9, "recur" on 196, "valid" (sufficient?) on line 227). Overall, could use another pass to make the writing more clear.
Questions
- Can you explain or justify your use of model entropy as a proxy for model performance? - The thresholding explanation on line 190 was a bit confusing -- can you explain this process in more detail?
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
2 fair
Contribution
4 excellent
Limitations
Yes
Summary
The authors address the problem of data minimization at inference time, which poses a real-world challenge in real-world applications, where users might want to hide sensitive or personal attributes. They provide an efficient algorithm to sequentially determine the appropriate attributes for an individual, with the goal to maintain the original predictive accuracy (based on all attributes).
Strengths
1. The considered problem is important and timely. 2. The proposed theoretical framework introduces some interesting novel concepts. 3. The paper is well motivated and well-written.
Weaknesses
1. The addressed problem is inherently a privacy problem; if some feature values are not explicitly available at inference time, it does not mean that they can not be inferred. Actually, in practice if the predictive quality does not change after hiding some feature values, it is a strong indication that these values can be inferred from the other values. 2. The overall objective of maintaining the original predictive quality with the minimum amount of private features is never explicitly formalized/defined. 3. In many real-world applications that use personal data, accuracy is the worst measure for predictive quality, so focusing on and reporting this measure is not really meaningful (e.g., when the goal is good model calibration on imbalanced classes). 4. Relevant related work has not been considered: I Prefer not to Say: Operationalizing Fair and User-guided Data Minimization T Leemann, M Pawelczyk, CT Eberle, G Kasneci
Questions
Can you comment on the weakness above and limitations below?
Rating
5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
2 fair
Presentation
2 fair
Contribution
2 fair
Limitations
The novelty of the work is rather limited, as relevant work on this topic has already addressed similar challenges. The formalization of the approach and the theoretical framework is limited as it mainly aims for maintaining the high accuracy, and it does not consider the true privacy of the features that users wish to hide. The evaluation is also focused on accuracy, which is not a meaningful measure in real-world ML applications based on tabular user data.
Summary
This paper considers the problem of data minimization at inference time. Consider a set of features X which consists of public features Xp, and private features X\Xp. A model has been trained with all the features X, i.e., f(X). Now, the goal is to allow for inference revealing only a subset of the private features Xr and keep some of them unrevealed Xu. In essence, X=Xp U Xr U Xu.
Strengths
The paper introduces a new and interesting problem, i.e., data minimization during inference time. They provide entropy-based measures to decide whether to include a feature or not. They also provide theoretical guarantees and experimental results.
Weaknesses
While the authors say this is the "first" work to do so, I think there are substantial similarities with the problem of feature selection or feature engineering as well as inference under missing data. The differences should be made clear with references. The use of the term leakage can be a bit confusing since leakage is used here for the number of features revealed. But of course, the features can just be random noise and hence not leak anything, whereas one feature can also be much informative of everything and cause leakage. I think a different terminology should be used here since leakage sounds more like "information" rather than "number of features". My most important concern: How does this approach compare with applying a local explanation framework and dropping the least important private features? For example, for each user, if you apply SHAP or LIME or even feature attributions, and then drop the private features with the least contribution for that local user. What performance would you get and how would that compare to your method? I would be happy to increase my rating based on a discussion/comparison with just applying existing local explanations for this problem statement.
Questions
See Weaknesses COMMENT: After rebuttal, I increased my score by 2 points.
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
3 good
Contribution
2 fair
Limitations
See Weaknesses (last point on my major concern)
Summary
The authors propose that in a large number of application of machine learning reasonable model accuracy can be realized without the model having access to the entire feature set. This has implications for privacy and data-sharing, as a model that adaptively selects features to solicit would retain model performance even when minimal sensitive data is revealed to the model.
Strengths
* The motivation for the paper is clear and important. The ability to reduce the amount of disclosed data is appealing and a thoughtful, timely contribution. * The authors attempt to address obvious questions that may arise, specifically around the relationship between the input features being non-linear.
Weaknesses
* the empirical evaluation of the model is somewhat weak. The authors do present results in terms of accuracy, however, there is no discussion as to what is the source of performance degradation, if any. It would be nice to see a more holistic evaluation that takes into account other aspects of the classifier performance, including ROC performance and calibration. * For linear classifiers, computing the argmax over the estimated entropy is easy as it factorizes over the individual dimensions of the core set. However, this may not be the case when the relationship between features is non-linear. Can the authors comment on this. Specifically can the presented algorithm still be tractable if higher-order interactions between core-set of features considered? * The current evaluation pipeline randomly assign attributes as un disclosed at random. I would recommend pre-specifying the disclosure rate based on certain notion of harm revelation of that feature would cause.
Questions
The authors proposed a feature sampling strategy based on greedy selection on the Exected Information Gain. Such a strategy has shown benefit in other areas of machine learning especially in active learning. There could be potentially many other well motivated acquisition functions in the context of the problem the authors present. Have the authors considered other such possibilities? If yes, can the authors comment as to why Expected Information Gain (Entropy) was selected as the most reasonable choice. The presented algorithm in its current stage does a one step-greedy lookahead which would work when the relationship between features is linear. Can the authors comment on tractability when looking at the power set of all potentia features that make the coreset? I am willing to tweak my scores based on engagement with the authors and other reviewers in the discussion phase.
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness
3 good
Presentation
2 fair
Contribution
3 good
Limitations
There are issues with model safety and trust when a model adaptively solicits information from a user. Specifically, can the authors comment on how such an approach might effect users trust in the system when the model seeks disparate information from disparate users? I am not looking for a theoretical argument here, but more of a value judgement based discussion of potential implications of disparate treatment under such a model.
Summary
The work presents a method to increase privacy of ML predictions at test time by asking users to reveal fewer features. The proposed method asks for features that are maximally informative of the prediction outcome given the features seen thus far and stops when the prediction outcome can be decided. The method addresses the case of linear as well as non-linear thresholded classifiers assuming Gaussian-distributed features and a local Taylor approximation of predicted label probability. Experiments on multiple real datasets show reduction in data required for similar accuracy as baselines.
Strengths
Writing is clear. The method is explained clearly step-by-step. I like the presentation of the results in the plots. Method is simple and is shown to work on real datasets. The idea of selecting maximally informative features until decision is reached is natural. The idea is executed well. Problem of reducing data required for a prediction is important to increase user privacy, so the method has practical significance.
Weaknesses
On the writing, some algorithmic details can be improved like mentioning the entropy calculation and calculating the core features sets for \delta>0. Core feature sets can be defined more rigorously by mentioning the sources of randomness in the probability expression. Results from datasets other than Credit, which are presented in Appendix, can be summarised in the main text. Reasons for the effectiveness of the method is not clear to me and are not sufficiently explored in experiments. This is needed given the success of simplifying assumptions on Gaussian distribution of features. Is this because of the dataset or model characteristics, or is due to the algorithm? Baselines such as removing all sensitive features might help check if dataset characteristics are the main contributor. An analysis of the examples which are predicted correctly without revealing features can shed more light. Some related work is missing. See detailed remarks. The technical contributions in light of this work is unclear. Theoretical analysis leaves many questions open e.g. the impact of approximations, what does optimal procedures look like, how much training data is needed to get significant privacy gains, how to extend the method to non-linear classifiers and high-dimensional data.
Questions
Notation in Definition 1 is unclear. What does the probability of prediction f_\theta mean for unobserved variables X_U? Do we take expectation over different values of X_U? An example of the meaning of this probability would help me. Similarly, how are the unrevealed variables in entropy calculations, e.g. in term A of equation (3), handled? Suppose we remove all 5 of the sensitive features, does this have significantly lower accuracy? That is, does choosing the sensitive features matter at all for prediction. How is entropy computed in equation 4? Please describe the Bayesian model used for the data. Consider adding the related work on following topics and discuss whether these are applicable to the problem setting. Active measurement of features e.g. Li and Oliva 2021 ‘Active Feature Acquisition with Generative Surrogate Models’ http://proceedings.mlr.press/v139/li21p.html Dynamic measurement of features in time e.g. Chang et al. 2019 ‘Dynamic Measurement Scheduling for Event Forecasting using Deep RL’ https://proceedings.mlr.press/v97/chang19a.html Feature pruning for causal effect estimation e.g. Makar et al. 2019 ‘A Distillation Approach to Data Efficient Individual Treatment Effect Estimation’ https://ojs.aaai.org/index.php/AAAI/article/view/4375 --- After the rebuttal My remaining concern relates to the second question above. Reasons for the success of the method are not clear from the experiments and how they are presented. For instance, seeing the accuracy of a baseline which removes all sensitive features (minimum data leakage) will help contextualize all line plots (e.g. percentage improvement from such a baseline can be the y-axis). This helps answer how much of the success is due to the method's feature selection versus predictability of the public features in the datasets. Further, a detailed analysis of the examples that are predicted correctly with < 2 sensitive features will be instructive (e.g. looking at whether these are the same set of features or personalized to the data point). This said I appreciate baselines included by authors to check the selection criteria and experiments to check effect of linearity, which are also required for a newly proposed method.
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
3 good
Contribution
2 fair
Limitations
Limitations on modeling assumptions and theoretical analysis are acknowledged. ## Minor comments, no response is aspected Line 4 of the Algorithm 1 to check core features should be explained in detail for the case of \delta>0. Please specify the assumption that input features are jointly Gaussian more prominently. e.g. in an Assumption environment, in the lines 177-180. Please cite information processing inequality in Proposition 2 in main text. Propositions 2 to 5 and Theorem 1 are known results so they can be mentioned in text or denoted as lemmas with references. The statement in line 174 does not require pointing to Proposition 1. It holds because of the definition of entropy. Please provide guidelines on how to use the Gaussian approximation for categorical features. Introduction is nicely written. However, the goal / objective of the paper is repeated multiple times which can be removed to be concise.
We wanted to reiterate our gratitude for your time and review and would like to check if you had any additional questions or comments. Also, it appears we had a formatting issue in the previous response. It should read: Absolutely! In our framework, we have to compute the distribution of $\tilde{f}_{\theta}$ over the uncertainty of certain unrevealed sensitive features. If the distribution of these unrevealed features follows a Gaussian distribution, then the distribution of the soft-label prediction is also linear, or approximately linear, in the case of non-linearity. Many thanks!
Thank you for your reply!
Thank you for your reply. Please find my answers below. Q1: “it is ineffective to use the model predictions to infer the original values of Income and Location“ ineffective doesn’t mean impossible. If it is possible to infer the original values of the sensitive values, your approach misses the motivational point, because what is the point of identifying the “appropriate attributes for each individual to provide“ if it is not privacy? Q2: A mathematical formulation of the objective would certainly be less ambiguous. Q3: I find it quite impractical to predict the hard labels directly. But if you decide to do so, you can still conduct a precision-recall analysis (in addition to accuracy). For multi-class cases, you can consider micro and macro averages. Q4: I think broadening the spectrum of different contexts (and related approaches) in which users would like to hide or provide sensitive information would greatly benefit the current work. For now, I will keep my initial score.
Thanks for answering our rebuttal. **Q1**: We urge you to review again the motivating example in Figure 1. We believe this will clarify your question. In that example, it is impossible to infer the sensitive attributes (location, Income) when Job, Loc, and Inc are mutually independent, i.e., $\Pr(\text{Loc}, \text{Inc}) = \Pr(\text{Loc}, \text{Inc} | \text{Job})$. However, if we observe $\text{Job} =1$, we know for sure $1* \text{Job} - 0.5 * \text{Loc} + 0.5 * \text{Inc} >= 1*1 - 0.5 * \text{Loc} + 0.5 * \text{Inc} >=0$ for any arbitrary values of Loc, Inc. Hence, we know the model prediction (**not the ground truth**) of that individual even though have not observed their Inc and Loc feature values. We notice that this reviewer has mentioned earlier the paper "I Prefer not to Say: Operationalizing Fair and User-guided Data Minimization T Leemann, M Pawelczyk, CT Eberle, G Kasneci". Our setting, motivation, and privacy notion are certainly different from those in such a paper. In our context, users are not given the option to choose which features to release; instead, entities such as the system, the bank, or the insurance company make that decision. The term "appropriate attributes" refers to specific features that the system believes, if released, can provide the most insight or additional information regarding the model's predictions. When all features are independent, the model will of course select the most important one. However, note that we focus on minimizing data at inference time, and the determination of the "most important" features is based on the training data, which is publicly available in our setting. Therefore, there is no privacy loss incurred in this process, within the setting of our paper. We will certainly take your other points into consideration. Thank you for the feedback! From your response, it also appears that we may have clarified all your concerns. Let us know if this is not the case and again we hope you could reconsider your score, in light of our responses to your questions.
I think you are imposing too many unrealistic constraints
Thank you again for your reply. Despite the fact that the motivating example is quite unrealistic, I agree that for independent features, the privacy desideratum for the sensitive attributes holds. Nevertheless, the independence assumption and the prediction of hard labels (which builds the basis of your approach) are quite impractical. I know the banking and financial services sector very well, and please believe me that the probability of default (PD) is the most fundamental concept/tool for the processes in this sector. Even when hard labels are used (e.g., for rule-based decision making in this sector), the PD ranges behind the labels are very well known and model calibration is a prime concern. Hence, I am not convinced by the usability aspect of the approach.
We want to make sure we convey the message that **our work does not rely on such an independence assumption**. We hope this is clear.
Summary of discussion
Thank you for the insightful discussion thus far. We'd like to provide a summary of our conversation and provide additional clarification, which, we hope serves to clarify all your doubts. **1.** Your initial question concerned the ability to reconstruct attributes that haven't been released. In many cases, reconstructing non-released attributes with high confidence (or 0-error) relies on models trained on redundant or highly correlated features. However, our work is about data minimization at test time and focuses on datasets lacking such redundancy. This is indeed the case in practice, where training datasets are curated to exclude highly redundant features. To provide further evidence, we've conducted new experiments to demonstrate the ineffectiveness of classical reconstruction attacks on the minimized inference data and are happy to include these in the final paper if deemed valuable by the reviewers. Another point we'd like to stress is that, in our work, the entity, not the user, decides which questions to ask, thereby filtering the information released. **2.** Your second question was related to our use of an English description for the problem objective formulation. While this choice was intentional to avoid additional notation, we have acknowledged your point and will include a mathematical description in response. **3.** Your third question related to hard label prediction. While hard label prediction is valuable in privacy-preserving ML --- since soft prediction can lead to leakage exploitable by adversaries (see, for instance, [1, 2, 3]) --- this restriction applies only to pure core feature sets (e.g., $\delta=0$). The presented approaches, however, are general and support "soft-label" predictions when $\delta > 0$. Our experiments, utilizing varying uncertainty levels of $\delta$, further illustrate this. [1] https://arxiv.org/abs/2209.10732 [2] https://arxiv.org/abs/2201.09370 [3] https://arxiv.org/abs/2009.08559 **4.** Your last point, was a suggestion to expand the scope to different contexts. We appreciate this suggestion! **5.** Finally, in response to your comment on related work, we emphasized that our work and setting significantly differ from the mentioned studies. We hope that this summary has clarified all of your doubts. Thank you again for your continued engagement.
**Q3**: Hard labels are particularly useful in scenarios where discrete decisions are required by organizations such as banks or insurance companies. For instance, they may be used to determine whether a user qualifies for a loan. Consider the motivating example of a logistic regression model given by $1 \times \text{Job} - 0.5 \times \text{Loc} + 0.5 \times \text{Inc} \geq 0$. If some users have their Job value of 1, we can confidently predict that their hard label will always be 1. However, their soft label, or prediction score, depends on the unrevealed attributes Inc and Loc. For example, user A with Job = 1, Loc = -1, and Inc = 1 will have a score of $ \frac{1}{1 + \exp(-2)}$, while user B with Job = 1, Loc = 1, and Inc = -1 will have a score of $ \frac{1}{1 + \exp(0)}$. By estimating only hard labels, users can reveal fewer sensitive features without compromising the model's accuracy. This approach not only minimizes privacy but also reduces the burden on the bank or institution and saves time for the users that have to provide their data. This efficiency comes at the cost of providing less information, as no soft labels or prediction scores are given. This trade-off aligns with the well-known principle of the 'no free lunch' theorem.
After the rebuttal
I thank the authors for providing a detailed response to my questions. Most of my concerns except on evaluation are addressed. I increased my score to 6. Weak Accept. Overall I am more positive of the paper due to its contribution as defining the feature selection problem in a new context (privacy, test-time feature selection), and the simplicity and effectiveness of the method. My remaining concern relates to Q2 in the rebuttal. Reasons for the success of the method are not clear from the experiments and how they are presented. For instance, seeing the accuracy of a baseline which removes all sensitive features (minimum data leakage) will help contextualize all line plots (e.g. percentage improvement from such a baseline can be the y-axis). This helps answer how much of the success is due to the method's feature selection versus predictability of the public features in the datasets. Further, a detailed analysis of the examples that are predicted correctly with < 2 sensitive features will be instructive (e.g. looking at whether these are the same set of features or personalized to the data point). This said I appreciate baselines included by authors to check the selection criteria and experiments to check effect of linearity, which are also required for a newly proposed method. My concerns on entropy calculation, and the notation are addressed -> I would suggest explicitly naming the standard Bayesian techniques (e.g. from [10]) used in the implementation as it is an important detail. I would also suggest including the clarification on the random variable f_theta in the Notation paragraph since the notation is otherwise ambiguous. Related work can be more detailed by discussing the feature acquisition literature.
Thank you for the positive assessment and for recognizing the novelty and significance of our work in terms of defining the concept of data minimization at inference time and its relation with privacy. Let us provide some additional details on our assessment: Firstly, we'd like to assure you that we have made a meticulous exploration of our results. This indeed included an analysis of instances that are accurately predicted with a minimal number of sensitive features. Even when restricted to k=1, we observed that the selected features are **not** uniform across the different users. We recognize the significance of this observation (thank you for your suggestion!) and will provide a more detailed explanation in the final version of our paper. Next, we agree with your recommendation to present our findings in the context of a minimum data leakage baseline. We have indeed conducted an evaluation under such conditions and it revealed a substantial decline in accuracy. We'll detail it in our revised manuscript, further substantiating our method's efficacy. Once again, thank you for your constructive feedback. We hope this addresses your last concern and that you could further champion our work.
Increasing score by 2 points
The rebuttal addresses my concern. For the final version, I would encourage the authors to (i) clarify the term leakage, and (ii) include an explicit discussion on applying local explanations. Increase: Borderline reject >> Weak accept
I appreciate your clarifications and think adding the revisions you've described here will improve the manuscript nicely. Regarding the choice of entropy as a metric, I still find your explanation and justification unsatisfying. If this work aims to "achieve better accuracy for the whole population while minimizing data leakage," then using model certainty or entropy as a proxy for accuracy requires theoretical and/or experimental justification. While you noted general relationships between disclosure and entropy and between disclosure and performance, these trends do not lead to the conclusion that entropy is a sufficient proxy for performance. While as you noted, exploring the relationship between disclosure and performance is difficult, one alternative is to make it clear that this paper focuses on improving **certainty** (not accuracy/performance) while minimizing "data leakage," and to remove claims about improving performance.
Thank you for your comment. We agree with your suggestion and will make it clearer in the paper that our primary focus is on minimizing data leakage while improving certainty, and, at the same time, ensuring that our claims are consistent with our focus and the evidence provided. Note also that in our work, entropy is used as a link to core feature sets, which, in turn, captures our concept of data leakage, which is of central interest in data minimization. Providing certificates on accuracy would indeed be a useful desiderata and is a topic of future exploration, but, we also note that this is the first work exploring data minimization at inference time and we believe will pave the way to additional significant contributions. Thank you again, we appreciate your support!
Decision
Accept (poster)