\text{A}^{4}\text{NT}: Author Attribute Anonymityby Adversarial Training of Neural Machine Translation
Table IV: A4NT anonymization fooling unseen classifiers, on blogdata (age). Columns are doc-level F1 score.
['[BOLD] Model', 'Seen Classifier', 'Holdout Classifiers Mean', 'Holdout Classifiers Max']
Generalization to other classifiers: An important question to answer if A4NT is to be applied to protect the privacy of author attributes, is how well it performs against unseen NLP based adversaries ? To test this we trained ten different attribute classifiers networks on the blog-age setting. These networks vary in architectures (LSTM, CNN and LSTM+CNN) and hyper-parameters (number of layers and number of units), but all of them achieve good performance in predicting the age attribute. The networks were chosen to reflect real-world architecture choices used for text classification. The column “mean” shows the mean performance of the ten classifiers and “max” shows the score of best performing classifier Holdout classifiers have good performance on the original text, achieving mean 0.85 document-level F1-score. They perform slightly worse than on the seen LSTM classifier, but are able to significantly drop the performance of all the holdout classifiers (mean F1 score drops from 0.85 to 0.53 or below). This is a strong empirical evidence that the transformations applied by the A4NT networks are not specific to the classifier they are trained with, but can also generalize to other adversaries.