Friedrich June 2024

# Winning Through Simplicity: Autonomous Car Design for Formula Student

Tobias Friedrich  Elefant Racing e.V. at University of Bayreuth, Bayreuth,
Germany  Marco Müller  Elefant Racing e.V. at University of Bayreuth,
Bayreuth, Germany  Adrian Bauske  Elefant Racing e.V. at University of
Bayreuth, Bayreuth, Germany  Simon Härtl  Elefant Racing e.V. at University of
Bayreuth, Bayreuth, Germany  Johannes Herrmann  Elefant Racing e.V. at
University of Bayreuth, Bayreuth, Germany  David Förster  Elefant Racing e.V.
at University of Bayreuth, Bayreuth, Germany  Tobias Tietze  Elefant Racing
e.V. at University of Bayreuth, Bayreuth, Germany  Sebastian Sartor  Elefant
Racing e.V. at University of Bayreuth, Bayreuth, Germany
<EMAIL_ADDRESS>+49 174 68694944

###### Abstract

This paper presents the design of an autonomous race car that is self-
designed, self-developed, and self-built by the Elefant Racing team at the
University of Bayreuth. The system is created to compete in the Formula
Student Driverless competition. Its primary focus is on the Acceleration
track, a straight 75-meter-long course, and the Skidpad track, which comprises
two circles forming an eight. Additionally, it is experimentally capable of
competing in the Autocross and Trackdrive events, which feature tracks with
previously unknown straights and curves. The paper details the hardware,
software and sensor setup employed during the 2020/2021 season. Despite being
developed by a small team with limited computer science expertise, the design
won the Formula Student East Engineering Design award. Emphasizing simplicity
and efficiency, the team employed streamlined techniques to achieve their
success.

###### keywords:

Autonomous Vehicle, Formula Student Driverless, Localization and Mapping,
Planning and Control, Autonomous Racecar

##  1 Introduction

Building on the pioneering efforts of other Formula Student teams, such as
those documented in [6], [10], [15], and [11], we have developed an autonomous
system for the race car of the Elefant Racing team at the University of
Bayreuth. The first section outlines the constraints and principles that
guided our design process. Subsequent sections detail the derived hardware
setup and software modules.

###  1.1 Design Constraints and Objectives

The autonomous system design follows the following constraints (C) and
objectives (O):

(C1) First-year team

As a first-year FSD team, there is no internal knowledge to build on.

(C2) Small team

There is a smaller number of students ($40-60\%$ of large teams), mainly
pursuing the Bachelor’s degree.

(C3) Few software developers

There are only 3 to 4 active students with a software developing background
($10-30\%$ of large teams, e.g. AMZ or TUFast)

(C4) Single old car for FSD and FSE with little space

The team also participates in Formula Student Electric (FSE) competitions
without an autonomous system. This is done with the same car due to (C2).
Hence, the autonomous system must be easily attachable and detachable. It must
not affect the performance when removed. The two-season building phase of the
base vehicle due to COVID-19 means that it has not been designed with
driverless components in mind.

(C5) No aerodynamic, weight, or power concerns

The targeted low speed and acceleration (40-50 km/h in Acceleration and 15-20
km/h in Skidpad) for the first driverless vehicle make these not necessary. A
powerful 1000W DCDC provides a reasonable power budget.

(O6) Safety & Rule Compliance

Only a quarter of all qualified teams competed in at least one dynamic
discipline at Formula Student Germany in 2019 [8]. This was mainly due to
hardware failures or rule non-compliance due to an insufficient safety
concept.

(O7) Robust against sensor errors

A reliable solution has to deal with sensor errors in perception and state
estimation.

(O8) Simplicity

Considering (C1, C2, O6) the simplest solution with the lowest complexity
should be chosen: "keep it simple, stupid (KISS)". It ensures easy knowledge
transfer, easy integration of new members, and a short development cycle.

(O9) Extensible

When possible and not contradicting (O8), methods and hardware should be
chosen that could be reused, extended and improved in the future.

(O10) Good direct sensor data instead of algorithms

In view of (C2, O7), the hardware should be carefully chosen such that the
algorithms are as easy as possible (O8) and provide a good foundation for
future systems (O9). In particular, relevant data should be directly measured
instead of estimated when possible.

(O11) Designed for Acceleration and Skidpad

Considering (C2, O8), the vehicle must compete in these two easier disciplines
in Formula Student. Participation in Autocross and Trackdrive is experimental.

##  2 Autonomous Hardware

1: Driverless Compute Unit (DCU); 2: Emergency Brake System (EBS); 3:
GNSS/IMU-system; 4: Electronic Box with LTE router; 5: GNSS antennas; 6:
Monocular cameras (near: 125° FOV; far: 50° FOV) in orange and stereo camera
(45° FOV) in blue; 7: Ground Speed Sensor Figure 1: Autonomous hardware

The autonomous hardware is shown in Figure 1. The boxes at the side replace
delicate aerodynamic components that might get damaged when hit by cones. One
rear aerodynamic wing is replaced by a carbon plate with a larger GNSS antenna
and a cutout for the camera system. All components are easily attachable by
connecting a few plugs and fastening some bolts (C4, C5).

###  2.1 Electric Motors for Acceleration and Deceleration

The vehicle is equipped with four electric wheel hub motors that are
controlled by the torque vectoring system. It is capable of braking by
recuperation. In particular, during normal autonomous operation the car is
decelerated only with the motors without the hydraulic disk brakes.

###  2.2 Emergency Brake System (EBS)

In view of (O6), the EBS safety concept has received much attention: The
emergency brake system is comprised of two completely independent pneumatic
and hydraulic circuits for the front and rear brake circuit, respectively (see
Figure 2). In case of an emergency, pressurized air from tanks flows into
pneumatic cylinders. They independently press on two brake master cylinders
(MMP11, MMP21) for the EBS. An EBS brake master cylinder (MMH1 or MMH2) and a
brake pedal master cylinder (MMH3 or MMH4) are connected to the inputs of a
shuttle valve. The higher of both pressures is available at the output which
is connected to the brakes.

Figure 2: Pneumatic and Hydraulic Circuits of EBS

A check-up-sequence runs before starting the car in manual mode or autonomous
mode. It checks that the EBS tanks are without pressure or that all parts of
the EBS are ready and pressurized, respectively. Considering (O6), the
software is tested against a simple dynamic simulation of the pneumatic
circuit. To this end, the system has been modelled by an equivalent electric
circuit made out of resistors, capacitors, and two-ports and integrated with a
simple forward Euler-scheme.
The sequence finds all modelled single component failures and most failures
with at most three failing components (see Table 1). Testing all failure
combinations was infeasible due to combinatorial explosion. It was found that
the pressure tank has to be supervised by at least two pressure sensors to
guarantee that the tanks are pressure-free for manual mode. Ideally, both
sensors should be directly connected to the tank. However, the rules mandate a
pressure regulator directly on the tank.

Connection |  Pressure Regulator | Electric Valve
---|---|---
large leakage | no regulation | always open
small leakage | too high | always closed
partially blocked | too low | no reset to open
blocked | low flow-rate |
Manual Valve | Pressure Sensor |  Air Cylinder w/ Hydraulics
wrong position | output disconn. | hydr. leakage
|  constant wrong output (different levels) |  wrong transfer function
Table 1: EBS failures for unit testing

###  2.3 Steering Actuator

The steering actuator is located at the steering rack. It consists of a rack
parallel ball screw driven by a brushless servo motor. It is coupled to the
steering rack via a cross bore and a shoulder screw. The ball screw’s low
coefficient of friction and lack of self-retention enables manual steering in
manual mode. The assembly can easily be removed from the car by removing the
eight bolts and the shoulder screw (Figure 3). This actuator is able to steer
from fully left to fully right in 0.4 seconds. Providing 2000 N at the rack to
steer while the car is not moving. Compared to past telemetry data from
previous Autocross runs, this reaches the performance of a manual driver 99
percent of the time.

Figure 3: Steering actuator with cross section and placement

###  2.4 Processing Units & further Electronics

All additional electronic processing components are located within two
ventilated boxes at the side of the car. This includes the Driverless Compute
Unit (DCU) made out of consumer miniature PC components (AMD Ryzen 3700X,
Nvidia 2070 Super). The boxes are designed larger than needed to plan for
extension or replacement (O9). The GNSS system profits from RTK correction
data from the internet, provided by a dual-SIM cellular router. As a fallback,
it can route the traffic over the long range directional antenna to an off-
track stationary cellular router. This connection is also used for telemetry
data.

###  2.5 Sensors

####  2.5.1 GNSS, IMU and ground speed velocity sensor

The state of the vehicle, in particular the (vehicle-frame) velocity, has to
be estimated (see State Estimation). The velocity is measured with a dual-
antenna GNSS system (Novatel PwrPak7D-E2) in case of good GNSS reception. To
deal with the likely case that the GNSS signal fails, it is also precisely
measured with an optical ground speed sensor (Kistler Correvit SFII) (O7,
O10). This allows redundancy without a complex vehicle model with unknown
parameters, without using wheel sensors and without estimating tire slip (O8,
O10). The inertial measurement unit (IMU) is needed to observe the vehicle
state fully. It is integrated into the GNSS receiver, which automatically
calibrates and corrects the IMU (O8, O10). In the case of good GNSS reception,
accurate absolute position and heading measurements from the dual-antenna-RTK-
GNSS support localization, testing, and data collection.

####  2.5.2 Camera and LiDAR system

For cones nearby, two slightly overlapping cameras (Basler acA1920-40 with a
Sony IMX249 CMOS 2.3 MP sensor) with combined HFOV of $125^{\circ}$ are used.
This has the downside that some cones are seen by both cameras. So matching
and deduplication is needed. For easy matching the parallax effect between
both cameras is minimized by placing the entry pupils of both cameras as near
as possible to each other.
Alternatively, a smaller HFOV ($100-110^{\circ}$) and a smaller effective
resolution per cone could also be reached with a single camera and an extreme
wide-angle lens. This would have the benefit of lower complexity (O8) since
each cone is only captured once. However, during corners, most curve-inside
cones are near the edge of the image where the distortion is the largest in
particular for a wide angled lens. Moreover, this provides no room for
improvements (O9), so we refrain from this solution.
Depth estimation (with errors of $\leavevmode\nobreak\ 0.3-3m$) is rather
challenging for cones further away (10-20m) with a single camera. So
additional sensors are needed.
LiDAR systems provide precise depth measurements almost irrespective of
distance and lighting conditions. Most LiDARs scan the points consecutively
and with a lower (vertical) resolution. This requires ego-motion-correction
with a dependency on velocity and yaw rate. Moreover, precise time
synchronization is needed. This makes early sensor fusion with reprojection of
LiDAR data into camera images complex, especially for the considerable small
cones. In late sensor fusion, the cones are detected independently in LiDAR
data and camera images. This requires an additional pure LiDAR detection
pipeline and a fusion step. Due to (C3, O8) we refrain from this solution.
However, flash LiDARs acquire all points in a single shot (cf. global shutter)
and with a higher vertical resolution. This makes reprojecting the points into
camera images easy when both sensors capture at the same time. This is an
ideal solution since depth data can just be considered an additional channel
in the image (C3, O8, O10).
However, some Flash-LiDARs are rather large and did not fit into the car
without heavy modification (C4). Others were not available or too expensive,
especially when excepting new models and price reductions in the future. With
this in mind, we assume that next season a flash LiDAR can be used.
As a drop-in replacement, this season, the stereo camera Nerian Karmin3D with
the stereo matching SceneScan Pro is used (O10) for cones further away.
Despite challenges mounting the larger camera rule compliant to the car, a
larger base length of 25cm has been chosen for more precise depth estimates
($0.4m$ at $20m$) (O10). It is accompanied by another mono-ocular camera for
future experiments, when the camera is replaced by a LiDAR.

####  2.5.3 Synchronization and Calibration

The processing units, including the Nerian SceneScan Pro, are synchronized
over Precision Time Protocol (PTP). The Nerian SceneScan Pro triggers all
cameras at the same time and sends the timestamped depth and color images over
Ethernet to the DCU, where they are matched with the image data from the USB
cameras. The ground speed sensor data is timestamped when received over CAN.
The cameras are extrinsically calibrated to each other using the usual
checkerboard pattern. The heading of the cameras with respect to the car axis
is done with a checkerboard placed exactly on the vehicle approximately
$10\textit{m}$ away. The remaining position and orientation of sensors and
antennas relative to each other and the vehicle are directly measured using a
total station and digital inclinometers. This makes the development of
calibration software unnecessary (C2, O6).

##  3 Testing & Data collection

Figure 4: Test Platform

Parts of the software have been tested on a test platform (see Figure 4)
equipped with all the sensors, batteries, and the compute units. Moreover,
this setup is used to collect images to train the neural network of the
Perception module. Using another RTK GNSS rover allows to set up official
tracks faster. Moreover, the global position of each cone is saved centimeter-
accurate. The position and heading of the test platform is also measured by an
RTK GNSS system. This allows validating and testing of the Localization
algorithm and the depth estimation in the perception module. Additionally,
images of cones in various environments have been taken.

##  4 Software

###  4.1 State Estimation

The state of the vehicle is estimated with an Extended Kalman Filter (EKF).
The main consumer of the state is the Localization and Mapping module, which
uses 111frames and variable names (almost) according to ISO 8855:

  * •

velocity $\vec{v}$ in the vehicle-frame (or the change of position in local
vehicle coordinates), in particular the longitudinal velocity $v_{x}$

  * •

yaw rate $r=\dot{\psi}$ (or the change of the heading $\psi$),

  * •

optionally if available the position $\vec{P}=(X,Y)$ and heading $\psi$ w.r.t.
an earth fixed ENU coordinate system

The Kalman Filter has to be designed such that it provides locally correct
estimates for $\vec{v}$ and $r$ with either the GNSS/IMU-system or the ground
speed sensor and the IMU only. The GNSS should update estimates for earth
fixed quantities $\vec{P}$ and $\psi$ whenever available.
To this end, we define state
$\vec{x}_{EKF}=(X,Y,\psi,v_{x},v_{y},r,a_{x},a_{y})^{t}$, where
$\vec{a}=(a_{x},a_{y})$ is the acceleration in the vehicle-frame. For the
predict step, the vehicle is modelled as a rigid body with almost constant
(earth fixed) acceleration and almost constant yaw rate. After a partial
coordinate transform, this is written as

$\displaystyle\dot{X}$
$\displaystyle=\cos(\psi)v_{x}-\sin(\psi)v_{y}+\varepsilon_{X}$
$\displaystyle\dot{Y}$
$\displaystyle=\sin(\psi)v_{x}+\cos(\psi)v_{y}+\varepsilon_{Y}$
$\displaystyle\dot{\vec{v}}$
$\displaystyle=\vec{a}+r(v_{y},-v_{x})^{t}+\varepsilon_{v}$
$\displaystyle\dot{\vec{a}}$ $\displaystyle=\varepsilon_{a}$
$\displaystyle\dot{\psi}$ $\displaystyle=r+\varepsilon_{\psi}$
$\displaystyle\dot{r}$ $\displaystyle=\varepsilon_{r}$

with independent process noise $\varepsilon_{X},\dots,\varepsilon_{r}$.
Experimentally, a kinematic bicycle model [7] can be used instead (see below).
The measurement model is formulated with sensor data already corrected for
misalignment and the GNSS/IMU-receiver (transformed into) in the vehicle
origin. The vehicle-frame position of the ground speed sensor (GSS) is
$\vec{p}_{GSS}$.

$\displaystyle(X_{GNSS},Y_{GNSS})^{t}$
$\displaystyle=(X,Y)^{t}+\varepsilon_{P,GNSS}$ (1) $\displaystyle\psi_{GNSS}$
$\displaystyle=\psi+\varepsilon_{\psi,GNSS}$ (2) $\displaystyle\vec{v}_{GNSS}$
$\displaystyle=\vec{v}+\varepsilon_{v,GNSS}$ (3) $\displaystyle\vec{a}_{IMU}$
$\displaystyle=\vec{a}+\varepsilon_{a,IMU}$ (4) $\displaystyle\vec{r}_{IMU}$
$\displaystyle=r+\varepsilon_{r,IMU}$ (5) $\displaystyle\vec{v}_{GSS}$
$\displaystyle=\vec{v}+r\vec{p}_{GSS}+\varepsilon_{v,GSS}$ (6)

Note that the IMU and GNSS measurements are already fused by the receiver. For
simplicity, we nevertheless assume independent measurement noise. In the best
case, all sensors work properly and all measurements (1) to (6) are
integrated. If the GNSS sensor fails, e.g. due to signal loss, only (4) to (6)
are used for the update step. The important state variables $\vec{v}$ and $r$
remain observable. The earth fixed state variable begins to drift. If only the
GSS fails, e.g. due to water on the track, we rely on the GNSS/IMU-system with
a minor loss in accuracy mainly for $v_{y}$. If the GNSS and the GSS both
fail, we switch from the rigid body model to the kinematic bicycle model using
only the IMU sensor.

###  4.2 Perception

From the point cloud of the stereo-camera the ground is extracted using
RANSAC. Then, the pose of the stereo camera relative to the ground is
computed. Knowing the relative poses of all cameras from calibration this
yields the pose of all cameras relative to the street. The other steps of the
pipeline run separately on the data from all cameras in parallel.
First, the neural network CENTERNET [3] is run on the color image. It extracts
bounding boxes and key points for all cones in a single shot. The key points
are extracted for easily distinguishable points (top of cone, corners of strip
of cone).
In the stereo-camera, the depth data within the bounding box is clustered. The
depth average of the cluster containing the midpoint of the bounding box,
yields a depth estimate $d$ for a cone. Since each cone’s shape is known, the
position $p_{i}$ of the point corresponding to a key point is known in a cone-
local frame. The position of a cone is determined by finding the position
$(x,y,z)$ of the cone such that the sum of the following (weighted) errors is
minimized

  * •

Reprojection error for the key points of $p_{i}$ weighted with the variance
matrix. The variance matrix is estimated from the errors between annotated key
points and the neural network’s output.

  * •

$(x-d)^{2}$ weighted with the factor $\lambda_{1}/x^{2}$

  * •

$z^{2}$ weighted with the factor $\lambda_{2}/(x^{2}+y^{2})$ to force cones on
the ground

###  4.3 Localization and Mapping

A simple and yet effective algorithm for mapping and localization is the
FastSLAM algorithm which is easier to understand than other common SLAM
algorithms (O8). Graph-based SLAM relies on a well-functioning front-end and
an effective and robust backend which is hard to tune. ORB-SLAM consists of
multiple, complex components and is available as open-source
software222https://github.com/UZ-SLAMLab/ORB_SLAM3 however adapting it to
Formula Student tracks is complicated.

FastSLAM version 2 uses visual information in the prediction step making it
more precise however this only works if the visual information is more
accurate than inertial information which is not the case for us[9, p. 14]
therefore we use version 1.

FastSLAM uses a particle filter where each particle has got information about
its 2D pose and its map (consisting of cones)[9, p. 9]. Each cone is
represented by a 2D EKF[12] and stores how often it has been seen ($n_{s}$)
and has not been observed even though it should have been ($n_{n}$). The
quality of a cone is determined by $\frac{n_{s}}{n_{s}+n_{n}}$ and deletes the
cone if below 0.5. Colors detected by perception are summed up which gives
sufficient information for the track detection.

Observed cones are matched to already existing cones by calculating the
Mahalanobis function (see 7) and randomly choosing one of the most likely
associations. Only cones in a certain radius around the car are considered for
matching to reduce computational complexity. As the car gets closer to the
formerly ambiguous cones the weighting of particles automatically eliminates
particles that made wrong data associations. Updating the cone position and
covariance is done using the standard EKF way and incorporating the
observation covariance in each step.

Resampling is done by using low variance resampling [1, p.3-4] which is
applied if the number of effective particles $n_{eff}$ drops below 50% of the
particle set size. Additionally, about 20% of particles are chosen and their
respective poses are randomly distributed to ensure particle exploration.

There are several weights (inspired by [5]) which are used for determining the
particle weight. If a cone is not observed even though in sensor range the
weight $w_{no}$ is applied, if a cone is observed but outside of sensor range
the weight $w_{or}$ is used. For new cone insertions $w_{nc}$ is taken
(different for each discipline). Matched cones are given the weight $w_{m}$
($z$ is the observed cone position, $\hat{z}$ the previous cone position) with
covariance $\Sigma$ which is the (component-wise) sum of the covariances of
the observed and already mapped cone (Mahalanobis function [14])

$\displaystyle z_{d}$ $\displaystyle=z-\hat{z}$ (7) $\displaystyle w_{m}$
$\displaystyle=\frac{1}{2\cdot\pi\cdot\sqrt{\det{\Sigma}}}\exp{(-\frac{1}{2}\cdot
z_{d}^{T}\cdot\Sigma^{-1}\cdot z_{d})}$ (8)

The pose of each particle is calculated by integrating over the velocities
($v_{x}$, $v_{y}$ and $r$=yaw rate) and sampling from the pose distribution.
Pose weights $w_{p}$ are calculated independently for x, y and heading by
using the Gaussian function[13] if GPS is available. The difference is
measured between the (integrated) pose and GPS pose and the standard
deviations of the GPS are used. This measure is used to avoid (problematic)
drifting of the pose.

This results in the total weight for a particle for time step $n+1$ (next
observation received) given by (exponents give number of occurrences; $o$
observed cones are matched and $r$ poses are received)

$w_{t,n+1}=w_{t,n}\cdot w_{no}^{i}\cdot w_{or}^{j}\cdot
w_{nc}^{k}\cdot\prod_{l=1}^{o}w_{m,l}\cdot\prod_{q=1}^{r}w_{p,q}$ (9)

The Skidpad and Acceleration disciplines are (almost) precisely defined by the
competition handbook[4] and are therefore hard-coded in FastSLAM with a
particular cone variance. The unknown acceleration track width is determined
by assigning each particle a different track width and letting the particle
filter sort out the track width and starting pose within two seconds. The pose
can be accurately tracked by FastSLAM even if the track is not exactly
straight and has slight bends in it. In Skidpad the two circles are defined
exactly and are hardcoded in the SLAM map with some variance in all directions
(pose is accurate as well).

For Autocross and Trackdrive there are no defined maps. Therefore FastSLAM
creates a map in the first round and freezes it for the following laps and
goes into localization mode (essentially Monte Carlo Localization, MCL [2])
which is sufficient for speeds of up to 30km/h.

####  4.3.1 Detection of Track Centerline

As the track layout for Acceleration and Skidpad is well known for these two
missions the track centerline is hardcoded and is independent of the detected
cones. The Localization algorithm takes care of minor imperfections in the
hardcoded cone positions.

Autocross and Trackdrive: To detect the centerline of the track from the cones
outputted by localization first of all cones are transformed into track gates.
Every cone is assigned one or more other cones and each pair is then saved as
a gate formed by those two cones. The position of the gate is the center point
of its two cones. We only consider paths formed by at least 3 gates. To this
end, we assign a cost to each path and gate of a path. The cost for a path is
the sum of the costs of its gates. With the following approach the cost of a
gate depends on the previous 2 gates only which reduces computational
resources drastically while maintaining the ability to also detect difficult
passages of track. Starting at the car’s starting point every gate within 8m
is assigned a cost using a cost function. Cost depends on: distance to the
last gate, distance of the two cones forming that gate, required car angle
change to pass through the gate, angle at which the car drives through the
gate, cone colors. Color costs are close to zero if cone colors are probable
to be correct. Costs are medium if color probabilities are not high (uncertain
color). Costs are high if both cones of a gate have the same color and very
high if cones have their colors inverted (blue and yellow on the wrong side).

The cheapest 3 gates are used as a new starting point and all gates around
those are costed again. This happens a third time to get a tree of depth three
and 3 branches at each node. Now the cheapest path (least sum of cost of
nodes) is evaluated and its first node is added to the track centerline. The
other two branches are discarded. By costing the gates around the leaves of
the now two depth tree, a third depth is added again.

This process continues until the start/finish line is found.

####  4.3.2 Planning and Control

Finding the optimal path and the current control outputs is done with Model-
Predictive-Control (MPC) techniques. This allows us to reach close to optimal
controls that can in the future easily be optimized even more by improving the
car model. At each iteration (every 50ms) we solve the following optimization
problem for our horizon $H=40$:

$\displaystyle\min_{(\Delta u)_{i}}$
$\displaystyle\sum_{k=0}^{H}q_{D}\cdot(\Delta
D)^{2}+q_{\phi}\cdot\phi^{2}-q_{v_{x}}\cdot v_{x}-q_{p}\cdot\Delta
p+q_{s}\cdot S_{c,k}^{2}+q_{d}\cdot d$ $\displaystyle s.t.$ $\displaystyle
x_{0}=x(0),$ $\displaystyle x_{k+1}=f(x_{k},u_{k},\Delta u_{k}),$
$\displaystyle d\leq(0.7m)^{2}+S_{c,k},$ $\displaystyle B_{l}\leq
G(x_{k},u_{k},\Delta u_{k})\leq B_{u}$
$\displaystyle\\!\\!\\!\\!\\!\\!\\!\\!\\!\\!\\!\\!where\;d=(X_{k}-X_{cen}(p_{k}))^{2}+(Y_{k}-Y_{cen}(p_{k}))^{2}$

$q_{i}$ are factors for cost adaption. We define $u=[\delta,D]^{T}$ and
$\Delta u=[\phi,\Delta D,\Delta p]^{T}$ with $\delta$ being the steering
angle, $\phi$ its derivation, $D$ being the current throttle command between
-100 and +100% and , $\Delta p$ the speed along the track centerline.
Furthermore we define $x=[X,Y,v_{x},v_{y},\theta,\dot{\theta},p]^{T}$ with $X$
and $Y$ being the position of the car in the map, $v_{x}$ and $v_{y}$ being
the respective velocities, $\theta$ orientation of the car in the map, yawrate
$\dot{\theta}$ and progress along the track $p$ in meters ($\dot{p}=\Delta
p$).

The vehicle is modelled with a kinematic vehicle model at slow speeds and a
dynamic vehicle model at higher speeds. They are blended linearly between 3
and 6 m/s. See [7] for models and [6] for blending.

$B_{l}$ and $B_{u}$ are upper and lower bounds of vehicle dynamics constraints
(max velocity, steering angle extrema, …) scaled by function $G(\dots)$. From
other modules we know the track centerline, parametrized as points that are
equally spaced 4m apart which are interpolated using a cubic spline with
spline parameter $p$ with $\Delta p$ being determined during the optimization
to always keep the car close to the track.

Negative weighting of $\Delta p$ and $v_{x}$ encourages progress along the
track and minimizes lap times. Penalization of $\Delta u$ smooths the
resulting maneuvers and reduces stress on the car.

To improve efficiency MPC is hot started with the last output being the new
starting point of the next optimization step.

##  5 References

## References

  * [1] Drew Bagnell and Tommy Liu “Particle Filters: The Good, The Bad, The Ugly”, 2012 URL: http://www.cs.cmu.edu/~16831-f14/notes/F11/16831_lecture04_tianyul.pdf
  * [2] F. Dellaert, D. Fox, W. Burgard and S. Thrun “Monte Carlo localization for mobile robots” In _Proceedings 1999 IEEE International Conference on Robotics and Automation (Cat. No.99CH36288C)_ 2, 1999, pp. 1322–1328 vol.2 DOI: 10.1109/ROBOT.1999.772544
  * [3] Kaiwen Duan et al. “Centernet: Keypoint triplets for object detection”, 2019
  * [4] FSG “FSG Handbook 2021”, 2021 URL: https://www.formulastudent.de/fileadmin/user_upload/all/2021/rules/FSG21_Competition_Handbook_v1.0.pdf
  * [5] Nikhil Bharadwaj Gosala et al. “Redundant Perception and State Estimation for Reliable Autonomous Racing” In _CoRR_ abs/1809.10099, 2018 arXiv: http://arxiv.org/abs/1809.10099
  * [6] J. Kabzan, M.. Valls, V..F. Reijgwart and H..C. al. “AMZ Driverless: The Full Autonomous Racing System”, 2019
  * [7] J. Kong, M. Pfeifer, G. Schildbach and F. Borrelli “Kinematic and Dynamic Vehicle Models for Autonomous Driving Control Design” In _IEEE Intelligent Vehicles Symposium (IV)_ , 2015
  * [8] “Results FSG 2019”, Accessed https://www.formulastudent.de/fsg/results/2019, 2019
  * [9] Sebastian Thrun et al. “FastSLAM: An Efficient Solution to the Simultaneous Localization And Mapping Problem with Unknown Data” In _Journal of Machine Learning Research_ 4, 2004
  * [10] Miguel I Valls et al. “Design of an autonomous racecar: Perception, state estimation and system integration” In _2018 IEEE international conference on robotics and automation (ICRA)_ , 2018, pp. 2048–2055 IEEE
  * [11] Miguel I. Valls et al. “Design of an Autonomous Racecar: Perception, State Estimation and System Integration” In _2018 IEEE International Conference on Robotics and Automation (ICRA)_ , 2018, pp. 2048–2055 DOI: 10.1109/ICRA.2018.8462829
  * [12] Wikipedia contributors “Extended Kalman filter — Wikipedia, The Free Encyclopedia” [Online; accessed 12-June-2021], 2021 URL: https://en.wikipedia.org/w/index.php?title=Extended_Kalman_filter&oldid=1004599218
  * [13] Wikipedia contributors “Gaussian function — Wikipedia, The Free Encyclopedia” [Online; accessed 15-May-2021], 2021 URL: https://en.wikipedia.org/w/index.php?title=Gaussian_function&oldid=1017028878
  * [14] Wikipedia contributors “Mahalanobis distance — Wikipedia, The Free Encyclopedia” [Online; accessed 12-June-2021], 2021 URL: https://en.wikipedia.org/w/index.php?title=Mahalanobis_distance&oldid=1027670189
  * [15] M. Zeilinger, R. Hauk and M. Bader “Design of an Autonomous Race Car for the Formula Student Driverless (FSD)” In _Proceedings of the OAGM & ARW Joint Workshop_, 2017


#  TAROT: Task-Oriented Authorship Obfuscation Using Policy
Optimization Methods

Gabriel Loiseau1,2 Damien Sileo2 Damien Riquet1 Maxime Meyer1 Marc Tommasi2
1Hornetsecurity, Hem, France
2Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189 - CRIStAL, F-59000 Lille,
France
<EMAIL_ADDRESS>
###### Abstract

Authorship obfuscation aims to disguise the identity of an author within a
text by altering the writing style, vocabulary, syntax, and other linguistic
features associated with the text author. This alteration needs to balance
privacy and utility. While strong obfuscation techniques can effectively hide
the author’s identity, they often degrade the quality and usefulness of the
text for its intended purpose. Conversely, maintaining high utility tends to
provide insufficient privacy, making it easier for an adversary to de-
anonymize the author. Thus, achieving an optimal trade-off between these two
conflicting objectives is crucial. In this paper, we propose TAROT: Task-
Oriented Authorship Obfuscation Using Policy Optimization, a new unsupervised
authorship obfuscation method whose goal is to optimize the privacy-utility
trade-off by regenerating the entire text considering its downstream utility.
Our approach leverages policy optimization as a fine-tuning paradigm over
small language models in order to rewrite texts by preserving author identity
and downstream task utility. We show that our approach largely reduce the
accuracy of attackers while preserving utility. We make our code and models
publicly available.111https://github.com/hornetsecurity/tarot

##  1 Introduction

Privacy is a critical consideration when developing and deploying trustworthy
machine learning systems. With the expansion of large language models (LLM),
large datasets are used for pretraining and fine-tuning models on a wide
variety of tasks. With this comes a risk of sensitive or personal information
being exposed or misused. Text anonymization is a technique that can address
these privacy concerns. It involves the process of removing or obfuscating the
author’s personal information from textual data. This helps protect the
privacy of individuals whose data is used to train models, however, it needs
to be performed in a way that still allows models to learn useful patterns and
insights from texts.

Figure 1: Illustration of the two versions of TAROT: We generate obfuscation
candidates and optimize the best policy using Reinforcement Learning and
preference optimization.

Currently, most work done on text anonymization focuses on redacting sensitive
entities in a given document Lison et al. (2021). This is sufficient for texts
where the only private aspects are entities, such as medical reports, court
cases, or biographies. But it is inadequate for removing author’s writing
style, or weak signals that can be used as hints for identification, which is
for example the case for blog articles or emails. Redacting entities in text
while keeping stylometric features linked to a specific individual would
eventually result in a leak of information. Indeed, the writing style is a
strong indicator of a person’s identity Mosteller and Wallace (1963). Prior
work done on authorship attribution highlights the large quantity of
information that can be extracted from seemingly anonymized texts and the ease
of identification of authors, especially for long documents Fabien et al.
(2020).

To solve this issue, authorship obfuscation (AO) aims to hide the author’s
identity by replacing some part of the text associated with authorship
indicators. Modifying the original text can impact its usability for specific
tasks (i.e. utility), and therefore badly affects the downstream performances
and text comprehension of machine learning models. The enforcement of privacy
creates a trade-off between privacy and utility, where keeping the original
text preserves the unchanged utility of the text, while not defending against
attribution attacks. On the other side, obfuscating the entire text guarantees
privacy, but leads to unusable text in practice.

Previous approaches design their obfuscation by maximizing the preserved text
content. They limit the modifications to small and targeted edits in order to
preserve text meaning and keep textual content as close as possible to the
original. As a result, those approaches often lead to insufficient
modification in the text, especially against realistic attack scenarios Zhai
et al. (2022).

To address these limitations, we reframe the AO problem into an adversarial
problem between two adversaries (e.g. machine learning models): one attacker
model whose goal is to reveal the identity of a given author from written
texts, and one utility model that aims to perform a given task using authors
data. The goal is to provide a modified version of the original text such that
the utility model can accurately perform its task while preventing the
attacker from identifying the author, making the obfuscation task-oriented.
The notion of task-oriented obfuscation/anonymization also takes its origin in
the law. As stated by GDPR European Parliament and Council of the European
Union (2016), the collection and process of personal information (including
written texts) have to be specified for a given usage.

In order to learn this privacy-utility trade-off, we use the combination of
supervised fine-tuning (SFT) and policy optimization (PO) to guide a
generative model into generating privacy- and utility-preserving outputs. Our
model learns to rewrite the text while removing potential authorship signals,
and preserving the text utility for a downstream task. This rewriting goal is
further validated by the conclusion of Weitzenboeck et al. (2022) which showed
how difficult it is to comply with GDPR requirements concerning text
anonymization without changing the entire text.

We fine-tune a text simplification model for AO using a customized reward
model. We design an unsupervised reward model for PO using 2 pretrained
sentence embedding models. The utility reward, penalizes the fact that the
General Text Embeddings Li et al. (2023) of the anonymized sentence is too far
removed from that of the original sentence. The author rewards does the
opposite on the embedding built by the Universal Authorship Representation
model from Rivera-Soto et al. (2021). Our final models are trained in an open-
world setting where the number of authors is not defined, same goes for the
end utility for our model to work on a multi-task setting. We also provide
experimentation on three different datasets, movie reviews, blog articles and
scholar documents. We show that TAROT can be used on multiple datasets
targeting different tasks while protecting authorship.

In summary, we list the main contributions as follows:

  * •

We design a new framework for task-oriented AO by leveraging PO algorithms to
maximize the end usage of data. The objective is to help reduce the
traditional constraints associated with utility preservation in the literature
(strict content preservation and semantic quality) by looking for a downstream
classification task to achieve with the anonymized data.

  * •

Starting from this framework, we propose TAROT, a task-oriented generation
model aiming to obfuscate text without any prior knowledge of the author
(making it unsupervised, and usable on any dataset, even if the authors are
not clearly indicated) while maximizing the utility for a variety of tasks. We
release two versions of TAROT from two different fine-tuning PO algorithms:
TAROT-PPO and TAROT-DPO.

  * •

We further evaluate TAROT on three datasets associated with different
classification tasks, using different authorship attackers and downstream
usage scenarios.

##  2 Related Work

#### Authorship Obfuscation

Obfuscation techniques can be regrouped into two categories, depending on
their implementation. Generic methods, on one hand, are methods that were not
explicitly designed for AO, but show interesting performance. These methods
include machine translation Altakrori et al. (2022); Keswani et al. (2016),
paraphrasing Krishna et al. (2023), or synonym replacements Potthast et al.
(2016).

More recently, advanced techniques were built explicitly for AO, often relying
on a trained attacker performing authorship attribution attacks on the
obfuscated text. Then, they perform accurate adversarial text edits from the
attacker knowledge on authors in order to obtain a privatized output. Mutant-X
Mahmood et al. (2019), is a genetic algorithm that utilizes GloVE Pennington
et al. (2014) word embeddings selected from an SVM or Random Forest attacker
to replace words in a document with similar ones.

Jamdec Fisher et al. (2024) is an unsupervised approach for obfuscating the
writing style of text while preserving semantics. It uses embedding-based and
likelihood-based methods, rather than attacker-based methods, to extract
keywords, then generates multiple text variations using Constrained Diverse
Beam Search on GPT2-XL (1.61B parameters). Finally, the candidates are
filtered using Natural Language Inference (NLI) and Corpus of Linguistic
Acceptability (CoLA) metrics to ensure coherence, content preservation, and
grammatical correctness.

Recently, ALISON Xing et al. (2024) employs a lightweight multilayer
perceptron classifier using part-of-speech (POS) sequences to guide
obfuscation, and leverages a BERT pre-trained language model to generate
replacement sequences. By ranking and replacing important POS n-grams, ALISON
obfuscates text uniformly, reducing classifier confidence.

#### Reinforcement Learning.

In NLP, reinforcement learning (RL) is often used to capture small signals
over word or sentence embedding. For example, Mosallanezhad et al. (2019)
proposes a text representation anonymization approach that employs deep
reinforcement learning to detect and modify text embeddings to maintain a good
privacy-utility trade-off.

With the expansion of Reinforcement Learning from Human Feedback (RLHF) as a
LLM fine-tuning paradigm, RL techniques have been leveraged to improve
language models with scalar metrics by optimizing rewards from (human)
feedbacks. It has emerged as a prominent tool for tackling undesirable
behaviors such as toxicity, social biases, and offensive language Ouyang et
al. (2022). This is accomplished by implementing PO algorithms to optimize a
language model (LM) by associating a reward with each generation, derived from
a trained reward model.

Very recently, Liu et al. (2024) introduced an authorship style transfer
method using PO. They optimize style transfer generation using style
similarity reward models. Authorship style transfer is similar to AO in the
way those task’s goal is to change within a text the author writing style.
However, style transfer assumes a distinct target style to achieve, whereas AO
assumes a lack of distinct style. Fisher et al. (2024) also showed the
ineffectiveness of style transfer for AO. To the best of our knowledge, our
work is the first one applying PO algorithms on AO.

##  3 Methodology

###  3.1 Problem Formulation

Let $x_{\text{ori}}$ represent the original document authored by a specific
author $a\in\mathcal{A}$. $\mathcal{A}$ denoting a predetermined set of
authors. The objective of authorship obfuscation is to generate a new
document, denoted as $x_{\text{obf}}$, which cannot be attributed to the
original author $a$. To assess the effectiveness of obfuscation, we employ a
classification model, denoted as $f_{priv}(\cdot)$ (i.e. an authorship
attribution model), which has been trained to distinguish documents based on
their respective authors within $\mathcal{A}$. The goal of authorship
obfuscation is to design an obfuscation method $O(\cdot)$, such that
$f_{priv}(O(x_{\text{ori}}))\neq f_{priv}(x_{\text{ori}}).$

In addition, a successful obfuscation algorithm would not only trick an
attacker into predicting the wrong author, but also preserve the document
utility for downstream usage. In this paper, instead of mainly measuring this
utility change though various semantic or content preservation metrics (i.e.
METEOR score, BERT score, …) we highlight the selection of a prior task
$\mathcal{T}$ in order to evaluate obfuscation with respect to $\mathcal{T}$.
We denote as $f_{\mathcal{T}}(\cdot)$ the classification model used for a
utility task. An ideal $O(\cdot)$ would preserve the original label
$f_{\mathcal{T}}(O(x_{\text{ori}}))=f_{\mathcal{T}}(x_{\text{ori}})$.

Note that $\mathcal{T}$ is likely not known when we train the obfuscation
model, underscoring the necessity for a versatile obfuscation strategy. This
task-agnostic approach prevents the obfuscation model from learning to
transform the text specifically to fit the label of $\mathcal{T}$, which would
compromise its generality across different tasks.

###  3.2 Framework Overview

Our task-oriented framework can be decomposed in two steps. First, we
initialize our generation model from a SFT baseline, this will first guide our
LM to generate modified versions of the input text instead of proceeding text
copy. Second, we apply a PO algorithm to fine-tune our SFT model. We
experiment with two different PO algorithms, Proximal Policy Optimization
Schulman et al. (2017) and Direct Preference Optimization Rafailov et al.
(2023) (see Figure 1). We optimize our SFT generations using a reward model
composed of both privacy and content preservation components.

###  3.3 Supervised fine-tuning

First, we use a fine-tuned LM to initiate our text generation task. We employ
the Keep It Simple222https://hf.co/philippelaban/keep_it_simple simplification
model Laban et al. (2021) as an SFT baseline. This model is a fine-tuned
version of GPT2-medium on the Newsela333https://newsela.com/ dataset for text
simplification. The utilization of a simplification model encourages a
reduction in the amount of information conveyed by a sentence, thereby
affording the opportunity to eliminate author-specific features. To our
knowledge, this is the first time that a simplification model has been used
for AO. Moreover, our framework is broadly compatible with any autoregressive
LM, and can be adapted with larger architectures and other generation tasks.

Dataset | Authors | Texts |  | Avg. Texts / Author
---
(std)
| Avg. Words / Text
---
(std)
| Avg. Tokens / Text
---
(std)
| Avg. Chars / Text
---
(std)
IMDb | $10$ | $10000$ | $1000(\pm 0)$ | $364(\pm 209)$ | $393(\pm 228)$ | $1869(\pm 1077)$
$20$ | $20000$ | $1000(\pm 0)$ | $345(\pm 209)$ | $371(\pm 225)$ | $1767(\pm 1081)$
BAC | $10$ | $23534$ | $2353(\pm 639)$ | $118(\pm 195)$ | $120(\pm 236)$ | $524(\pm 1027)$
$20$ | $39379$ | $1969(\pm 599)$ | $118(\pm 175)$ | $123(\pm 214)$ | $529(\pm 921)$
AMT | $10$ | $196$ | $20(\pm 2)$ | $497(\pm 14)$ | $592(\pm 41)$ | $2956(\pm 194)$
$20$ | $362$ | $18(\pm 2)$ | $502(\pm 102)$ | $590(\pm 38)$ | $2956(\pm 207)$

Table 1: Dataset statistics

###  3.4 Policy Optimization Algorithms

We use two different PO algorithms to optimize generations of our SFT
baseline. The Proximal Policy Optimization (PPO) Schulman et al. (2017)
algorithm is a policy gradient method whose goal is to optimize a policy with
respect to continuous rewards. In our case, a policy is a generation strategy,
i.e. a final LM. Initialized from the SFT policy, we sample completions $y$
given prompts $x$ and the reward model parametrized by $\phi$ produces a score
$r_{\phi}(x,y)$ based on these completions. The reward score $r_{\phi}(x,y)$
is then combined with a Kullback–Leibler (KL) penalty to ensure the policy
does not deviate too much from the SFT policy (leading to unusable
generations). Specifically, the reward of the RL problem is:

$R(x,y)=r_{\phi}(x,y)-\beta\mathbb{D}_{\textrm{KL}}\bigl{[}\pi_{\theta}(y\mid
x)\mid\mid\pi_{\text{SFT}}(y\mid x)\bigr{]}$

where $\beta$ is a parameter controlling the strength of the KL penalty,
$\theta$ the parameters of RL policy $\pi_{\theta}$, and $r_{\phi}$ the reward
model with parameters $\phi$. Then, PPO is used to maximize the following
objective:

$\max_{\pi_{\theta}}\
\mathbb{E}_{x\sim\mathcal{D}_{\text{SFT}},y\sim\pi_{\theta}(y\mid x)}R(x,y)$

where $\mathcal{D}_{\text{SFT}}$ is the prompts in the SFT dataset.

Rafailov et al. (2023) later introduced the Direct Preference Optimization
(DPO) algorithm, which implicitly optimizes the same objective as PPO. DPO
directly optimizes the model by a straightforward contrastive loss, boosting
the reward of the preferred generation $y_{c}$ and penalizing the one of the
non-preferred generation $y_{r}$ from a prompt $x$. DPO is a RL-free approach
which has the following loss:

$-\log\sigma\left(\beta\log\frac{\pi_{\theta}(y_{c}\mid
x)}{\pi_{\text{SFT}}(y_{c}\mid x)}-\beta\log\frac{\pi_{\theta}(y_{r}\mid
x)}{\pi_{\text{SFT}}(y_{r}\mid x)}\right)$

where $\sigma$ is the sigmoid function, and $\beta$ the scaling parameter. In
this study, we lack access to a preference dataset for DPO fine-tuning.
Consequently, following the methodology of Rafailov et al. (2023), we generate
this dataset by sampling responses from the same SFT dataset, and we rank
those preferences using the same reward model (see Appendix A.3). This is
justified as it is not possible to obtain a preference dataset from human
feedback in the AO setting.

##  4 Experimental Setup

In this section, we describe the datasets involved for training and evaluation
of our resulting models, and present our custom reward targeting the open-
world authorship verification and multi-task text embeddings to learn this AO
task. We then evaluate the resulting obfuscation against text edition and
rewriting baselines.

###  4.1 Datasets

#### Training

We use a separate dataset to train our PO models. We fine-tune our base
simplification model on the Yelp reviews
dataset444https://hf.co/datasets/yelp_review_full Zhang et al. (2015) composed
of reviews from Yelp. The dataset is extracted from the Yelp Dataset Challenge
2015. This dataset is employed in an unsupervised way, to ensure we train our
models on a large number of authors.

#### Evaluation

To evaluate our obfuscation models, we use three different datasets. (i)
IMDb62555https://hf.co/datasets/tasksource/imdb62, is a subset of the IMDb
Authorship Attribution dataset initially presented by Seroussi et al. (2014).
It consists of 62 authors with 1,000 texts per author taken from IMDb movie
reviews. The utility task associated with this dataset is the review
sentiment. For this, we map the movie rating between 0 and 10 associated with
each review to a sentiment between _positive_ and _negative_. A positive
review occurs when the review rating is strictly larger than 5. (ii) The Blog
Authorship Corpus666https://u.cs.biu.ac.il/~koppel/BlogCorpus.htm dataset
Schler et al. (2006) consists of aggregated blog posts from 19,320 bloggers
gathered from blogger.com. We pick the list of 13 topics present in the
dataset as the utility task. (iii) The Extended-Brennan-
Greenstadt777https://hf.co/datasets/tasksource/Drexel-AMT dataset Brennan et
al. (2012) is composed of short paragraphs about scholar subjects gathered
from 42 different authors from Amazon Mechanical Turk. The utility task of
this dataset is indicated by the “background” column, as a binary
classification problem.

For all datasets, we create two subsets containing the texts from 10 and 20
authors. For the Blog Authorship Corpus, we select the authors with the
highest number of texts. We select the 10 (resp. 20) first authors listed in
IMDb62 and Extended-Brennan-Greenstadt. We report summary statistics of each
dataset in Table 1 and refer to every dataset as IMDb, BAC, and AMT followed
by the number of considered authors. In summary, IMDb has rather long texts,
numerous texts per author with a large associated standard deviation. BAC
texts are shorter, with a higher number of texts per author compared to IMDb.
Finally, for the AMT dataset, the texts are the longest with few variations,
and the number of texts per author is the smallest.

###  4.2 Reward Models

To perform PO, we build a reward model from two different rewards components
targeting respectively text semantics and text authorship, aiming to
disentangle privacy and utility to control the trade-off.

For utility, we use a pretrained General Text Embeddings (GTE) Li et al.
(2023) to represent the reward as a cosine similarity between GTE before and
after obfuscation888We use the gte-large-en-v1.5 from sentence-transformers
https://hf.co/Alibaba-NLP/gte-large-en-v1.5. Denote as $\mathrm{GTE}(x)$ the
embedding vector of size 1024, our utility reward is defined as:

$R_{util}=\mathrm{cossim}(\mathrm{GTE}(x_{ori}),\mathrm{GTE}(x_{obf}))$

For the privacy reward, we use the Learning Universal Authorship
Representations model (LUAR), from Rivera-Soto et al. (2021). LUAR’s goal is
to transform a given text into a 512 dimensions embeddeding, such that
representations of texts by the same author are closer, according to cosine
similarity, than those by other authors.

Denote as $\mathrm{LUAR}(x)$ the embedding vector given by the LUAR model, our
privacy reward is defined as:

$R_{priv}=1-\mathrm{cossim}(\mathrm{LUAR}(x_{ori}),\mathrm{LUAR}(x_{obf}))$

where $\mathrm{cossim}$ denotes the cosine similarity.

We obtain our final reward by summing the two previous rewards:

$R=R_{util}+R_{priv}$

All implementations details are listed in Appendix A.1.

###  4.3 Evaluation

#### Privacy Metrics

The goal for obfuscation is to change the text in order to reduce as much as
possible the attacker accuracy. We employ authorship attribution as an
evaluation attacker to simulate an attack scenario when the attacker has
already access to some sample data of targeted authors to train an attacker
classifier. This is a stronger scenario than directly using the reward model
as evaluation, since it only assumes one-to-one comparison between texts. For
each evaluation dataset, we train a DeBERTa-v3 He et al. (2021) model as an
authorship attribution classifier. We split each evaluation dataset in 80%,
10% 10% for training, validation and testing.We measure the accuracy of the
attacker model on each test set.

#### Utility Metrics

We evaluate the utility loss when performing obfuscation similarly to the
privacy classifier. For each downstream task dataset, we train a DeBERTa model
to quantify utility preservation after text obfuscation. In addition, we also
measure the impact on content preservation and soundness (see Appendix B).

#### Baselines

We use the following baselines:

##### Original Text

We measure the performance of utility / privacy classifiers when evaluated on
original data, the goal of AO would be to decrease the performance of privacy
classifiers without decreasing too much the accuracy of utility classifiers.

##### Synonyms

As a baseline, we perform a naive text edition using synonyms. We use
GPTZzz999https://github.com/Declipsonator/GPTZzzs to process original texts,
it employs a dictionary of synonyms to replace a given proportion of words
with their counterparts. The goal of this baseline is to evaluate the attacker
behavior when very small edits are made in the original text.

##### ALISON

We use ALISON, a recent state-of-the-art text edition AO model leveraging
small replacements using a pretrained BERT model. Replacements spans are
computed using a threshold on the explanations of an adversarial authorship
attribution classifier trained on each evaluation dataset. We train this
classifier on each training and validation set before evaluation.

##### GPT-3.5

Lastly, we include a comparison with GPT3.5 (gpt-3.5-turbo) Ouyang et al.
(2022) as a text generation baseline. We use a simple text obfuscation prompt
to capture zero-shot capabilities of GPT-3.5 to perform AO. The prompt used
can be found in Appendix A.2.

| IMDb | BAC | AMT
---|---|---|---
Method | 10 Authors | 20 Authors | 10 Authors | 20 Authors | 10 Authors | 20 Authors
| Util. $\uparrow$ | Attr. $\downarrow$ | Util. $\uparrow$ | Attr. $\downarrow$ | Util. $\uparrow$ | Attr. $\downarrow$ | Util. $\uparrow$ | Attr. $\downarrow$ | Util. $\uparrow$ | Attr. $\downarrow$ | Util. $\uparrow$ | Attr. $\downarrow$
Original | 73.51 | 99.78 | 79.46 | 99.80 | 46.73 | 61.05 | 53.80 | 61.14 | 100 | 70.37 | 86.11 | 42.86
Synonyms | 70.38 | 94.52 | 76.60 | 96.08 | 46.24 | 59.06 | 51.20 | 58.18 | 91.67 | 64.81 | 86.11 | 36.90
ALISON | 61.88 | 89.59 | 65.72 | 91.02 | 40.70 | 40.67 | 41.00 | 39.22 | 91.67 | 70.37 | 73.33 | 35.84
GPT-3.5 | 63.33 | 66.67 | 47.37 | 35.00 | 37.20 | 42.73 | 44.74 | 31.27 | 60.00 | 44.44 | 61.11 | 31.14
SFT | 64.51 | 62.50 | 39.47 | 80.00 | 40.41 | 32.44 | 40.10 | 28.28 | 90.00 | 26.85 | 75.00 | 21.23
TAROT-PPO | 63.54 | 88.89 | 47.37 | 71.67 | 35.38 | 29.14 | 42.30 | 33.62 | 90.00 | 35.19 | 72.22 | 17.86
TAROT-DPO | 57.14 | 34.74 | 60.72 | 17.34 | 24.57 | 23.97 | 28.39 | 16.42 | 86.67 | 22.22 | 64.18 | 16.67

Table 2: Evaluation results (Util: classifier accuracy on utility labels,
Attr: authorship attribution accuracy) Best values are bolded.

###  4.4 Realistic Attackers

So far, the considered privacy evaluation adopts the perspective of an
attacker who does not have any knowledge about the obfuscation algorithm used.
In a more realistic setting, the attacker can likely identify and reproduce
the AO model, and perform more advanced attacks by creating adversarial threat
models. Following Zhai et al. (2022), we also evaluate our obfuscation models
against two enhanced authorship attribution attackers, better suited to
simulate real world attack scenarios. We list the different attackers and
their specific aspects:

  * •

Data Augmentation: The attacker is aware of which algorithm was used to
perform AO. This knowledge is used to create a new attribution model combining
texts from both the original source and obfuscated texts generated from the AO
algorithm.

  * •

Adversarial: The attacker is also aware of the AO algorithm, but use the
obfuscated training samples only as a training set for the authorship
attribution classifier. Zhai et al. (2022) showed that this attack setting is
the one having the higher performances on text edition obfuscations.

For each attack scenario, we train a new authorship attribution classifier
using the same parameters (see Appendix A.4 for hyperparameters) and compare
the accuracy change from the original attacker.

###  4.5 Training new utility models with obfuscated texts

We experiment with a second use case to evaluate the downstream utility of
obfuscated texts. We use the obfuscated texts of each method as a new training
set for our utility classifier. This is useful to evaluate each method
capability to generate useful training data that can be further used to train
a new classifier on the same utility task.

##  5 Results

#### Downstream Effectiveness

In Table 2, we present the accuracy change of privacy and utility classifiers.
We observe that both SFT, PPO and DPO reduce the attacker accuracy compared to
text edition methods (Synonyms and ALISON). PO helps to learn a good privacy-
utility trade-off by largely improving the privacy of obfuscated texts
compared to baselines, while preserving similar utility. We observe that DPO
consistently outperforms the PPO algorithm on privacy preservation, while
using the same base reward model. DPO is also the best-performing privacy
preservation over all baselines, with a notable drop of $82,46\%$ on IMDB-20.
Note that the utility decrease is larger for the BAC dataset, which could be
explained by the number of short texts contained in the dataset, whose edits
affect a lot more the end utility. TAROT-DPO also outperforms GPT-3.5 by
providing more utility and less attribution on IMDB-20, AMT-10 and AMT-20. The
effectiveness of TAROT-PPO lays in its utility preservation capabilities.
While not being as private, the utility drop is reduced on nearly each dataset
compared to TAROT-DPO.

#### Adversarial Attackers

Figure 2 highlights the accuracy of adversarial threat models on the IMDb-10
dataset, both attackers reduce the original attacker accuracy drop once
retrained using obfuscated texts for the Synonyms approach and Alison.
However, text generation methods (GPT-3.5, SFT, TAROT-PPO and TAROT-DPO) are
resistant to adversarial threat models, and only GPT-3.5 and TAROT-DPO suffer
from a performance decrease from the data augmentation attack. This encourages
the path of generation methods as promising obfuscators. Note that this is the
first obfuscation approach that is shown to be resistant to threat models. As
Zhai et al. (2022) did not include generation models in their study of AO
evaluation.

#### Utility Preservation after Retraining

Figure 3 presents the accuracy of a new utility classifier once trained with
obfuscated texts. We observe that the drop in accuracy caused by obfuscation
can be compensated by training a new classifier, with an accuracy increase for
all methods. Moreover, generation methods are even better candidates for
training data, as the final accuracy is higher than the original classifier
accuracy. TAROT-PPO and TAROT-DPO are the best-performing approaches on this
dataset. This highlights the possibility of creating obfuscation methods that
are both preserving privacy and keeping utility for training purposes.

Figure 2: Adversarial training accuracy results on IMDB-10 (lower is better). Generation models are resistant to adversarial training, compared to text edition methods. Figure 3: Utility classifier accuracy once trained on IMDB-10 obfuscated texts (higher is better). The  red line indicates the classifier accuracy when trained and evaluated on original data. The overall utility always increases after training on obfuscated texts, this is key to compensate the utility drop of generation methods. Method |  Output
---|---
Original |  I loved the whole story even though it was a tad corny at times . I think great acting and the content of the story kept it going.
Synonyms |  I loved the quite whole story very even though it was a tad corny at times. I imagine too outstanding playing and the contents of the story kept it sledding.
ALISON |  I thoroughly enjoyed the entire story even it did have a tad corny at times. I believe the great acting and the story’s content were the main reasons to keep it going.
GPT-3.5 |  The entirety of the narrative was quite delightful, despite occasional moments of cheesiness. I believe the stellar performances and the substance of the storyline sustained its momentum.
SFT |  I loved the whole story. It had many good parts and the writing was excellent. I think great acting and the subject matter of the story kept it going.
TAROT-PPO |  I loved the whole thing. It was a good story and well-written. It also kept me going at times. I think great acting and the content of the story kept me going.
TAROT-DPO |  I love the whole story. It’s full of action, personality and humour. It keeps me going, though, and the content keeps me going.
Table 3:  Obfuscation example from the IMDb dataset.

#### Qualitative Analysis

We show an obfuscation example in Table 3 for each method. The base Synonyms
obfuscation results in awkward phrasing and less natural language,
compromising readability. ALISON maintains coherence and clarity with slight
formalization (“thoroughly enjoyed” instead of “loved”). GPT-3.5 significantly
rephrases the text using sophisticated language. SFT simplifies and shortens
the text, retaining clarity but reducing stylistic nuances. TAROT-PPO
simplifies further, introducing some repetition, which makes the text less
formal but still clear. TAROT-DPO alters the content more significantly,
introducing new themes and repetition that can distract from the original
meaning. The application of PO assists the text simplification SFT model in
making additional modifications to the text. Although these changes in some
cases alter the text’s meaning, they preserve its overall utility.

#### Ablation Study

As a complement, we perform an ablation study of each component of our reward
model in Appendix D. It confirms the importance of using a combination of both
privacy and utility rewards to learn this trade-off in obfuscation, especially
for PPO.

##  6 Conclusion

We introduced a novel authorship obfuscation framework that focuses on
optimizing the privacy-utility trade-off for a specific downstream data usage.
We fine-tuned a text simplification model using two policy optimization
algorithms to obfuscate the authorship of a given text, while preserving
utility for multiple tasks. Our end-models are tuned using two sentence
embedding rewards, one for content preservation and one for privacy, resulting
in an unsupervised approach made for the open-world authorship setting. The
results obtained help to improve the privacy from state-of-the-art AO methods,
while preserving task utility. Additionally, we show that generated texts can
be used to retrain utility classifier and increase their performances, while
limiting the accuracy of more advanced attackers. This calls for more research
to design robust evaluation benchmarks for obfuscation systems, to assess and
catch failure cases that can map to different real-world scenarios.

##  7 Limitations

The use of LM as text generators for obfuscation is not without risks, LM are
known for their hallucination capabilities, so even if the downstream task is
not affected, there is still a possibility that the trained LM generated
plausible but false text from the original text. As we did not study the
content preservation of resulting texts, we do not emphasize the risk of
spread of misinformation or harm that can be generated by our fine-tuned LM.

Another limitation of our approach is that we rely on very small language
models (380M parameters for GPT2-medium, our SFT baseline), which benefits
from limited memory usage but suffers from a restricted context size for
generation. As a result, our method tends to reduce the text length,
especially for longer texts. This limitation could be mitigated by increasing
the size of the SFT model.

Finally, these methods can be limited when applied to short texts, as the
replacements creates significant changes that directly affect the utility
task.

##  8 Ethical considerations

In this work, we present authorship obfuscation methods that are intended for
beneficial purposes (learning insights from data while preserving privacy).
But we recognize that this task presents some risks of misuse. It can
facilitate harmful activities such as posting misinformation, spam, or harmful
content, without accountability because of obfuscation. Moreover, these
techniques might infringe on intellectual property rights by obscuring the
authorship of creative works, depriving creators of their deserved credit. We
strongly encourage users to carefully consider these potential dangers before
employing such methods.

## References

  * Altakrori et al. (2022) Malik Altakrori, Thomas Scialom, Benjamin C. M. Fung, and Jackie Chi Kit Cheung. 2022.  A multifaceted framework to evaluate evasion, content preservation, and misattribution in authorship obfuscation techniques.  In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_ , pages 2391–2406, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
  * Brennan et al. (2012) Michael Brennan, Sadia Afroz, and Rachel Greenstadt. 2012.  Adversarial stylometry: Circumventing authorship recognition to preserve privacy and anonymity.  _ACM Trans. Inf. Syst. Secur._ , 15(3).
  * European Parliament and Council of the European Union (2016) European Parliament and Council of the European Union. 2016.  General data protection regulation (GDPR).
  * Fabien et al. (2020) Maël Fabien, Esau Villatoro-Tello, Petr Motlicek, and Shantipriya Parida. 2020.  BertAA : BERT fine-tuning for authorship attribution.  In _Proceedings of the 17th International Conference on Natural Language Processing (ICON)_ , pages 127–137, Indian Institute of Technology Patna, Patna, India. NLP Association of India (NLPAI).
  * Fisher et al. (2024) Jillian Fisher, Ximing Lu, Jaehun Jung, Liwei Jiang, Zaid Harchaoui, and Yejin Choi. 2024.  Jamdec: Unsupervised authorship obfuscation using constrained decoding over small language models.  _arXiv preprint arXiv:2402.08761_.
  * He et al. (2021) Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2021.  Deberta: Decoding-enhanced bert with disentangled attention.  In _International Conference on Learning Representations_.
  * Keswani et al. (2016) Yashwant Keswani, Harsh Trivedi, Parth Mehta, and Prasenjit Majumder. 2016.  Author masking through translation.  In _Working Notes of CLEF 2016 - Conference and Labs of the Evaluation forum, Évora, Portugal, 5-8 September, 2016_ , volume 1609 of _CEUR Workshop Proceedings_ , pages 890–894. CEUR-WS.org.
  * Krishna et al. (2023) Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023.  Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense.  _arXiv preprint arXiv:2303.13408_.
  * Laban et al. (2021) Philippe Laban, Tobias Schnabel, Paul Bennett, and Marti A. Hearst. 2021.  Keep it simple: Unsupervised simplification of multi-paragraph text.  In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pages 6365–6378, Online. Association for Computational Linguistics.
  * Li et al. (2023) Zehan Li, Xin Zhang, Yanzhao Zhang, Dingkun Long, Pengjun Xie, and Meishan Zhang. 2023.  Towards general text embeddings with multi-stage contrastive learning.
  * Lison et al. (2021) Pierre Lison, Ildikó Pilán, David Sanchez, Montserrat Batet, and Lilja Øvrelid. 2021.  Anonymisation models for text data: State of the art, challenges and future directions.  In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pages 4188–4203, Online. Association for Computational Linguistics.
  * Liu et al. (2024) Shuai Liu, Shantanu Agarwal, and Jonathan May. 2024.  Authorship style transfer with policy optimization.
  * Mahmood et al. (2019) Asad Mahmood, Faizan Ahmad, Zubair Shafiq, Padmini Srinivasan, and Fareed Zaffar. 2019.  A girl has no name: Automated authorship obfuscation using mutant-x.  _Proceedings on Privacy Enhancing Technologies_ , 2019(4):54–71.
  * Mosallanezhad et al. (2019) Ahmadreza Mosallanezhad, Ghazaleh Beigi, and Huan Liu. 2019.  Deep reinforcement learning-based text anonymization against private-attribute inference.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 2360–2369, Hong Kong, China. Association for Computational Linguistics.
  * Mosteller and Wallace (1963) Frederick Mosteller and David L. Wallace. 1963.  Inference in an authorship problem.  _Journal of the American Statistical Association_ , 58(302):275–309.
  * Ouyang et al. (2022) Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022.  Training language models to follow instructions with human feedback.
  * Pennington et al. (2014) Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014.  GloVe: Global vectors for word representation.  In _Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pages 1532–1543, Doha, Qatar. Association for Computational Linguistics.
  * Potthast et al. (2016) Martin Potthast, Matthias Hagen, and Benno Stein. 2016.  Author obfuscation: Attacking the state of the art in authorship verification.  In _Conference and Labs of the Evaluation Forum_.
  * Rafailov et al. (2023) Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2023.  Direct preference optimization: Your language model is secretly a reward model.
  * Rivera-Soto et al. (2021) Rafael A. Rivera-Soto, Olivia Elizabeth Miano, Juanita Ordonez, Barry Y. Chen, Aleem Khan, Marcus Bishop, and Nicholas Andrews. 2021.  Learning universal authorship representations.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 913–919, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Schler et al. (2006) Jonathan Schler, Moshe Koppel, Shlomo Engelson Argamon, and James W. Pennebaker. 2006.  Effects of age and gender on blogging.  In _AAAI Spring Symposium: Computational Approaches to Analyzing Weblogs_.
  * Schulman et al. (2017) John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017.  Proximal policy optimization algorithms.
  * Seroussi et al. (2014) Yanir Seroussi, Ingrid Zukerman, and Fabian Bohnert. 2014.  Authorship attribution with topic models.  _Computational Linguistics_ , 40(2):269–310.
  * Weitzenboeck et al. (2022) Emily M Weitzenboeck, Pierre Lison, Malgorzata Cyndecka, and Malcolm Langford. 2022.  The GDPR and unstructured data: is anonymization possible? _International Data Privacy Law_ , 12(3):184–206.
  * Xing et al. (2024) Eric Xing, Saranya Venkatraman, Thai Le, and Dongwon Lee. 2024.  Alison: Fast and effective stylometric authorship obfuscation.  In _AAAI_.
  * Zhai et al. (2022) Wanyue Zhai, Jonathan Rusert, Zubair Shafiq, and Padmini Srinivasan. 2022.  Adversarial authorship attribution for deobfuscation.  In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_ , pages 7372–7384, Dublin, Ireland. Association for Computational Linguistics.
  * Zhang et al. (2015) Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015.  Character-level convolutional networks for text classification.  In _Advances in Neural Information Processing Systems_ , volume 28. Curran Associates, Inc.

##  Appendix A Experimentation Details

###  A.1 Hardware and code

We conducted all experiments with Nvidia A30 GPU card with 24GB memory and
Intel Xeon Gold 5320 CPU. The main libraries used include Pytorch 2.2.2,
Huggingface transformers 4.39.3, datasets 2.19.0, tokenizers 0.15.2, trl
0.8.6, evaluate 0.4.1 and sentence-transformers 3.0.0. Due to memory
constraints, models are loaded with float16 mixed precision.

Training time for PPO ranges from 15-20 hours, while time for DPO ranges from
6-12 hours. Evaluation time ranges approximately from 19-32 hours.

###  A.2 GPT-3.5 prompt

In our study, we compare with zero-shot prompting using GPT-3.5, a model with
approximately 175 billion parameters. We obfuscate each text on a paragraph
level, where the entire text is obfuscated as a unit. We use the following
prompt to generate obfuscated texts: "Rewrite the following paragraph so that
the author’s style is obfuscated."

###  A.3 DPO training

While both PPO and DPO algorithms methods aim to optimize a model’s
performance based on a reward function, they differ in their approach to
policy optimization. PPO uses a surrogate objective function that approximates
the true objective function, while DPO directly optimizes the likelihood of
generating a response chosen from a preference dataset over another response.
This preference dataset is typically collected by having human annotators
compare pairs of responses generated by a model and indicate which one is
preferred. However, this protocol is impractical for authorship obfuscation
because it is difficult to evaluate with human annotations. Therefore, we
apply an initial preprocessing step to generate the preference dataset before
DPO fine-tuning. We generate preference pairs from SFT outputs, and rank these
preferences using the same reward model as PPO. Algorithm 1 outlines our
method for creating this preference dataset for DPO. Preliminary experiments
showed that removing samples with closely similar authorship rewards
accelerates training convergence. So we specify filtering thresholds
$\epsilon_{priv}$ and $\epsilon_{util}$. After testing multiple values, we set
$\epsilon_{priv}=0.10$ and $\epsilon_{util}=0.05$

Algorithm 1 Preference Dataset Generation

SFT dataset $\mathcal{D}$, privacy threshold $\epsilon_{priv}$, utility
threshold $\epsilon_{util}$

prompts = []

chosen = []

rejected = []

for prompt $\in\mathcal{D}$ do

left, right = generations from the SFT model

$R_{util-left}$, $R_{priv-left}$ = privacy and utility rewards from the left
obfuscation candidate

$R_{util-right}$, $R_{priv-right}$ = privacy and utility rewards from the
right obfuscation candidate

if $\|R_{priv-right}$ \- $R_{priv-left}\|>\epsilon_{priv}$ and $\|R_{util-
right}$ \- $R_{util-left}\|<\epsilon_{util}$ then

if $R_{priv-right}$ > $R_{priv-left}$ then

prompt.append(prompt)

chosen.append(right)

reject.append(left)

else

prompt.append(prompt)

chosen.append(left)

reject.append(right)

return prompts, chosen, rejected

###  A.4 Hyperparameters

Table 4 and Table 5 present hyperparameters used for PO algorithms and
evaluation classifiers. Due to limited time and computational resources, we
are unable to conduct an exhaustive search across all hyperparameters.
Instead, we report the best-performing hyperparameters we identified.

|  TAROT-PPO |  TAROT-DPO
---|---|---
learning rate | 1.47e-5 | 2.96e-5
batch size | 16 | 32
# epochs | 3 | 3
KL coef / beta | 0.2 | 0.1
top p | 1.0 | 1.0
temperature | 1.0 | 1.0

Table 4:  Training hyperparameters for PO algorithms.

| DeBERTa (Privacy) | DeBERTa (Utility)
---|---|---
learning rate | 2e-5 | 2e-5
batch size | 8 | 8
# epochs | 3 | 3

Table 5:  Training hyperparameters for evaluation models.

###  A.5 Baseline implementation details

##### Synonyms

We use GPTZzz to process original texts, it employs a dictionary of synonyms
to replace a given proportion of words with their counterparts. The goal of
this baseline is to evaluate the attacker behavior when very small edits are
made in the original text. We use the FinNLP synonym list and ask the
algorithm to change up to 90% of words, and 80% of adjectives.

##### ALISON

We use the author’s code implementation of ALISON, we use the largest edition
parameters ($L=250$ and $c=1$) to edit the final text as much as possible.

##### GPT3.5

We use the gpt-3.5-turbo API endpoint from OpenAI to compute obfuscation, with
default temperature, max_tokens and top_p.

##  Appendix B Content preservation and soundness study

We also study the impact on content preservation when obfuscating the text
with generation models, including TAROT. Table 6 presents multiple content
preservation metrics on the IMDB-10 dataset. Naturally, text edition methods
obtain the best content preservation scores, compared to generation methods.
In contrast, generation methods are superior in terms of linguistic
acceptability (CoLA), since they generate the complete text as a whole. TAROT-
DPO outperforms other methods on this metric.

| Rouge-1 | Rouge-2 | Rouge-L | BLEU | METEOR | BERT Score | CoLA
---|---|---|---|---|---|---|---
Original | - | - | - | - | - | - | 69.31
Synonyms | 83.86 | 68.61 | 83.68 | 64.64 | 92.41 | 94.61 | 30.20
ALISON | 98.24 | 97.08 | 98.19 | 67.48 | 97.61 | 99.01 | 43.88
GPT-3.5 | 38.13 | 11.90 | 29.15 | 6.81 | 33.61 | 81.81 | 73.82
SFT | 55.69 | 34.04 | 43.20 | 24.06 | 41.13 | 85.58 | 66.66
TAROT-PPO | 51.33 | 29.36 | 38.67 | 20.77 | 37.93 | 84.50 | 74.46
TAROT-DPO | 42.52 | 17.27 | 29.14 | 10.77 | 30.04 | 80.56 | 81.10
Table 6:  Content preservation scores on the IMDB-10 dataset.

##  Appendix C Complete Evaluation Results

Figure 4 presents the complete evaluation results of adversarial training on
all datasets.

Figure 5 presents the complete utility evaluation after retraining on each
dataset. The findings presented for IMDb-10 persist for IMDB-20 and AMT-20. We
observe a smaller change in utility over the AMT-10 dataset due to the high
base accuracy of the original classifier (1.0). However, this result does not
hold for the BAC-10 and BAC-20 datasets, which is due to the lack of utility
preserved after obfuscation. The blog authorship corpus dataset consists
mainly of short texts, making it challenging for rewriting methods to
transform the text without significantly affecting utility. This issue
persists even after retraining the classifier on the obfuscated data.

Figure 4: Adversarial training accuracy results (lower is better). Figure 5:
Utility classifier accuracy once trained on obfuscated texts (higher is
better). The  red line indicates the classifier accuracy when trained and
evaluated on original data.

##  Appendix D Reward model ablation study

We perform a reward model ablation study to evaluate the importance of each
reward component. Table 7 presents the reward value after training on
different setups. We observe that the utility preservation and privacy
components are both necessary to balance the privacy-utility trade-off. When
we remove the LUAR-based reward, it leads to better GTE similarity at the
expense of privacy. Similarly, removing the GTE reward leads to better privacy
scores at the expense of utility. In practice, removing the privacy reward
leads to models that try to copy the original text. While removing the utility
reward leads to very short text, with only few words.

Method |  TAROT-PPO |  TAROT-DPO
---|---|---
| LUAR | GTE | LUAR | GTE
No privacy | 0.975 | 0.993 | 0.983 | 0.977
No utility | 0.403 | 0.421 | 0.706 | 0.633
No ablation | 0.931 | 0.825 | 0.915 | 0.738

Table 7: Reward model values when removing one component. A high LUAR value
indicates low privacy, and a high GTE value high utility.

##  Appendix E Scientific Artifacts

We list in this section the licenses used in this paper:

#### Models

DeBERTa-v3 (MIT) Keep It Simple (apache-2.0) LUAR (apache-2.0) GTE
(apache-2.0)

#### Software

GPTZzz (GPL-3.0) ALISON (MIT) GPT-3.5 (Terms of
use101010https://openai.com/policies) Pytorch (BSD-3) Huggingface
transformers, transformers, datasets, trl, evaluate and sentence-transformers
(apache-2.0)


# SU-RUG at the CoNLL-SIGMORPHON 2017 shared task:
Morphological Inflection with Attentional Sequence-to-Sequence Models

Robert Östling
Department of Linguistics
Stockholm University
Sweden
<EMAIL_ADDRESS>
Johannes Bjerva
Center for Language and Cognition Groningen
University of Groningen
The Netherlands
<EMAIL_ADDRESS>
∗This work was carried out while the second author was visiting the Department
of Linguistics, Stockholm University.

###### Abstract

This paper describes the Stockholm University/University of Groningen (SU-RUG)
system for the SIGMORPHON 2017 shared task on morphological inflection. Our
system is based on an attentional sequence-to-sequence neural network model
using Long Short-Term Memory (LSTM) cells, with joint training of
morphological inflection and the inverse transformation, i.e. lemmatization
and morphological analysis. Our system outperforms the baseline with a large
margin, and our submission ranks as the $4_{th}$ best team for the track we
participate in (task 1, high-resource).

##  1 Introduction

We focus on task 1 of the SIGMORPHON 2017 shared task (Cotterell et al.,
2017), morphological inflection. The task is to learn the mapping from a lemma
and morphological description to the corresponding inflected form. For
instance, the English verb lemma torment with the features 3.sg.prs should be
mapped to torments. As our model is poorly suited for low-resource conditions,
we only submitted results for the 51 languages with high-resource training
data available in the shared task (i.e., excluding Scottish Gaelic).

##  2 Background

The results of the SIGMORPHON 2016 shared task (Cotterell et al., 2016)
indicated that the attentional sequence-to-sequence model of Bahdanau et al.
(2014) is very suitable for this task (Kann and Schütze, 2016), so we use this
framework as the basis of our model.

A recent trend in neural machine translation is to use back-translated text
(Sennrich et al., 2016) as a way to benefit from additional monolingual data
in the target language. There is also work on translation models with
reconstruction loss, which encourages solutions that can be translated back to
their original (Tu et al., 2016). These developments are technically similar
to our semi-supervised training below.

##  3 Method

Figure 1: System architecture, consisting of an attentional sequence-to-
sequence model with LSTMs.

Our system is based on the attentional sequence-to-sequence model of Bahdanau
et al. (2014) with Long Short-Term Memory (LSTM) cells (Hochreiter and
Schmidhuber, 1997) and variational dropout Gal and Ghahramani (2016). The main
innovation is that our inflection model is trained jointly with the reverse
process, that is, lemmatization and morphological analysis. This can be done
in two ways:

  1. 1.

Fully supervised, where we simply train the forward (inflection) and backward
(lemmatization and morphological analysis) model jointly with shared character
embeddings.

  2. 2.

Semi-supervised, where supervised examples are mixed with examples where only
the inflected target form is used. This form is passed first through the
backward model, a greedy search to obtain a unique lemma, and finally through
the forward model to reconstruct the inflected form.

Our official submission only includes results from fully supervised training
(method 1), due to time constraints, but sec:results contains a comparison
between the two versions on the development set. The system architecture is
shown in Figure 1 for the forward (inflection) model. The backward
(lemmatizer) model has separate parameters, except the embeddings, but is
structurally identical except for two details: instead of passing the
morphological feature information to the decoder (via a single fully connected
layer), we predict the features from the final state of the encoder LSTM (via
a separate fully connected layer).

Our implementation is based on the Chainer library (Tokui et al., 2015) and
available at github.com/bjerva/sigmorphon2017.

##  4 Model configuration

For the official submission, we use 128 LSTM cells for the (unidirectional)
encoder, decoder, attention mechanism, character embeddings, as well as for
the fully connected layers for morphological features encoding/prediciton. We
use a dropout factor of 0.5 throughout the network, including the recurrent
parts. For optimization, we use Adam (Kingma and Ba, 2015) with default
parameters. Each model is trained for 48 hours on a single CPU, using a batch-
size of 64, and the model parameters during this time that give the lowest
development set mean Levenshtein distance are saved. For the official
submission, we used an ensemble of two such models, using a beam search of
width 10 to select the final inflection candidate.

##  5 Results and Analysis

The system has high performance in general, with a macro-average accuracy of
93.6%, and edit distance of 0.14. This is substantially higher than the
baseline (77.8% accuracy and 0.5 edit distance), and ranks as the $9_{th}$
best run, and $4_{th}$ best team in this SIGMORPHON 2017 shared task setting.
Furthermore, the difference in scores between our run and the best run overall
is low ($1.75\%$ accuracy and $0.04$ edit distance). Table 1 contains a
detailed version of the official results our system on the shared task, in the
high setting of Task 1.

Table 1: Our system’s official results on the SIGMORPHON-2017 shared task-1 test set in the high setting.  Language | Accuracy | Edit dist.
---|---|---
Albanian | 97.9 | 0.07
Arabic | 89.8 | 0.39
Armenian | 95.6 | 0.08
Basque | 100.0 | 0.00
Bengali | 99.0 | 0.05
Bulgarian | 96.7 | 0.07
Catalan | 97.8 | 0.06
Czech | 92.0 | 0.15
Danish | 93.8 | 0.09
Dutch | 95.9 | 0.07
English | 96.6 | 0.07
Estonian | 96.8 | 0.08
Faroese | 84.6 | 0.31
Finnish | 91.0 | 0.17
French | 87.5 | 0.24
Georgian | 97.6 | 0.05
German | 89.5 | 0.21
Haida | 95.0 | 0.10
Hebrew | 99.0 | 0.01
Hindi | 99.8 | 0.00
Hungarian | 84.8 | 0.35
Icelandic | 86.3 | 0.25
Irish | 87.6 | 0.35
Italian | 96.8 | 0.09
Khaling | 98.3 | 0.03
Kurmanji | 93.8 | 0.10
Latin | 75.3 | 0.39
Latvian | 95.4 | 0.08
Lithuanian | 91.0 | 0.15
Lower Sorbian | 96.9 | 0.06
Macedonian | 96.6 | 0.06
Navajo | 88.9 | 0.28
Northern Sami | 94.5 | 0.12
Norwegian (Bokmål) | 92.4 | 0.13
Norwegian (Nynorsk) | 89.4 | 0.18
Persian | 99.3 | 0.01
Polish | 90.6 | 0.22
Portuguese | 98.8 | 0.02
Quechua | 100.0 | 0.00
Romanian | 86.4 | 0.42
Russian | 89.3 | 0.31
Serbo-Croatian | 90.1 | 0.24
Slovak | 93.1 | 0.13
Slovene | 96.6 | 0.07
Sorani | 88.6 | 0.14
Spanish | 93.5 | 0.15
Swedish | 91.8 | 0.13
Turkish | 96.6 | 0.11
Ukrainian | 94.2 | 0.11
Urdu | 99.7 | 0.01
Welsh | 99.0 | 0.03
Average | 93.6 | 0.14
Table 2: Our system’s result on the SIGMORPHON-2017 shared task-1 development set, comparing fully supervised training (Full) to our semi-supervised method (Semi). | Accuracy
---|---
Language | Full | Semi
Albanian | 97.6 | 97.0
Arabic | 93.0 | 93.1
Armenian | 96.9 | 97.1
Basque | 99.0 | 99.0
Bengali | 99.0 | 99.0
Bulgarian | 95.8 | 96.0
Catalan | 98.0 | 98.3
Czech | 92.5 | 93.1
Danish | 95.8 | 95.9
Dutch | 96.8 | 97.1
English | 96.6 | 96.3
Estonian | 97.4 | 97.6
Faroese | 86.7 | 87.1
Finnish | 91.2 | 91.4
French | 89.8 | 89.3
Georgian | 97.9 | 97.9
German | 87.8 | 89.6
Hebrew | 98.8 | 98.7
Hindi | 99.9 | 99.8
Hungarian | 86.8 | 87.1
Icelandic | 88.1 | 88.6
Irish | 89.0 | 89.5
Italian | 97.0 | 97.2
Kurmanji | 92.4 | 92.7
Latin | 75.6 | 75.9
Latvian | 95.2 | 96.4
Lithuanian | 90.3 | 89.6
Lower Sorbian | 97.7 | 96.3
Macedonian | 95.3 | 95.0
Navajo | 88.2 | 85.2
Northern Sami | 94.4 | 93.5
Norwegian (Bokmål) | 91.8 | 92.7
Norwegian (Nynorsk) | 92.3 | 92.4
Persian | 99.5 | 99.6
Polish | 91.0 | 92.0
Portuguese | 98.6 | 98.0
Quechua | 100.0 | 100.0
Romanian | 87.4 | 88.2
Russian | 89.8 | 88.1
Serbo-Croatian | 89.5 | 89.7
Slovak | 95.2 | 94.8
Slovene | 96.7 | 97.0
Sorani | 90.9 | 90.3
Spanish | 94.3 | 95.7
Swedish | 90.9 | 90.1
Turkish | 97.5 | 97.2
Ukrainian | 94.0 | 92.7
Urdu | 99.5 | 99.2
Welsh | 100.0 | 100.0
Average | 93.9 | 93.8

Notably, the system has an accuracy of 100% on both Basque and Quechua, which
indicates that it is capable of fully learning the rules of very regular
morphological systems. The relatively high accuracy on Semitic languages
(Arabic: 89.8%, Hebrew: 99.0%) again confirms the ability of encoder-decoder
models to also handle non-concatenative morphology.

Latin has the lowest accuracy by far, and the reason seems to be that the
provided shared task data lacks vowel length distinctions in the lemma but
uses them in the inflected forms. This missing lexical information is
difficult to predict accurately. Evaluating with vowel length distinctions
gives an accuracy of 75.6% (Latin development set), compared to 91.5% without.
The latter accuracy score is in line with other Romance languages (French
90.8%, Spanish 94.3%, Italian 97.0%).

We also investigated whether the semi-supervised approach described in
sec:method has any effect on accuracy. The results on the development set,
presented in tab:results-semi, indicate that there is no systematic effect
(the macro-averaged accuracy drops marginally from 93.9% to 93.8%).

##  6 Conclusions

We implemented a system using an attentional sequence-to-sequence model with
Long Short-Term Memory (LSTM) cells. As our model is poorly suited for low-
resource conditions, we only participated in the high-resource setting. Our
inflection model is trained jointly with the reverse process, that is,
lemmatization and morphological analysis. The system significantly outperforms
the baseline system, and performs well compared to other submitted systems,
showing that this approach is very suitable for morphological inflection,
given sufficient amounts of data.

## Acknowledgments

The authors would like to thank the reviewers, and Johan Sjons for their
comments on previous versions of this manuscript. This work was partially
funded by the NWO–VICI grant “Lost in Translation – Found in Meaning”
(288-89-003). This work was performed on the Abel Cluster, owned by the
University of Oslo and the Norwegian metacenter for High Performance Computing
(NOTUR), and operated by the Department for Research Computing at USIT, the
University of Oslo IT-department.

## References

  * Bahdanau et al. (2014) Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. 2014.  Neural machine translation by jointly learning to align and translate.  CoRR abs/1409.0473.
  * Cotterell et al. (2017) Ryan Cotterell, Christo Kirov, John Sylak-Glassman, Géraldine Walther, Ekaterina Vylomova, Patrick Xia, Manaal Faruqui, Sandra Kübler, David Yarowsky, Jason Eisner, and Mans Hulden. 2017.  The CoNLL-SIGMORPHON 2017 shared task: Universal morphological reinflection in 52 languages.  In Proceedings of the CoNLL-SIGMORPHON 2017 Shared Task: Universal Morphological Reinflection. Association for Computational Linguistics, Vancouver, Canada.
  * Cotterell et al. (2016) Ryan Cotterell, Christo Kirov, John Sylak-Glassman, David Yarowsky, Jason Eisner, and Mans Hulden. 2016.  The sigmorphon 2016 shared task: Morphological reinflection.  In Proceedings of the 14th SIGMORPHON Workshop on Computational Research in Phonetics, Phonology, and Morphology. Association for Computational Linguistics, Berlin, Germany, pages 10–22.
  * Gal and Ghahramani (2016) Yarin Gal and Zoubin Ghahramani. 2016.  A theoretically grounded application of dropout in recurrent neural networks.  In Advances in Neural Information Processing Systems 29 (NIPS).
  * Hochreiter and Schmidhuber (1997) Sepp Hochreiter and Jürgen Schmidhuber. 1997.  Long short-term memory.  Neural Computation 9(8):1735–1780.
  * Kann and Schütze (2016) Katharina Kann and Hinrich Schütze. 2016.  Med: The lmu system for the sigmorphon 2016 shared task on morphological reinflection.  In Proceedings of the 14th SIGMORPHON Workshop on Computational Research in Phonetics, Phonology, and Morphology. Association for Computational Linguistics, Berlin, Germany, pages 62–70.
  * Kingma and Ba (2015) Diederik P. Kingma and Jimmy Ba. 2015.  Adam: A method for stochastic optimization.  In The International Conference on Learning Representations.
  * Sennrich et al. (2016) Rico Sennrich, Barry Haddow, and Alexandra Birch. 2016.  Improving neural machine translation models with monolingual data.  In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Berlin, Germany, pages 86–96.
  * Tokui et al. (2015) Seiya Tokui, Kenta Oono, Shohei Hido, and Justin Clayton. 2015.  Chainer: a next-generation open source framework for deep learning.  In Proceedings of Workshop on Machine Learning Systems (LearningSys) in The Twenty-ninth Annual Conference on Neural Information Processing Systems (NIPS).
  * Tu et al. (2016) Zhaopeng Tu, Yang Liu, Lifeng Shang, Xiaohua Liu, and Hang Li. 2016.  Neural machine translation with reconstruction.  CoRR abs/1611.01874.