GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models

Abstract

Deep learning has achieved overwhelming success, spanning from discriminative models to generative models. In particular, deep generative models have facilitated a new level of performance in a myriad of areas, ranging from media manipulation to sanitized dataset generation. Despite the great success, the potential risks of privacy breach caused by generative models have not been analyzed systematically. In this paper, we focus on membership inference attack against deep generative models that reveals information about the training data used for victim models. Specifically, we present the first taxonomy of membership inference attacks, encompassing not only existing attacks but also our novel ones. In addition, we propose the first generic attack model that can be instantiated in a large range of settings and is applicable to various kinds of deep generative models. Moreover, we provide a theoretically grounded attack calibration technique, which consistently boosts the attack performance in all cases, across different attack settings, data modalities, and training configurations. We complement the systematic analysis of attack performance by a comprehensive experimental study, that investigates the effectiveness of various attacks w.r.t. model type and training configurations, over three diverse application scenarios (i.e., images, medical data, and location data).

arXiv commentCCS 2020, 20 pages

References in corpus (31)

• Adam: A Method for Stochastic Optimization
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Auto-Encoding Variational Bayes
• Deep Learning with Differential Privacy
• GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
• WaveNet: A Generative Model for Raw Audio
• Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Stochastic Backpropagation and Approximate Inference in Deep Generative Models
• Generative Adversarial Network in Medical Imaging: A Review
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• NICE: Non-linear Independent Components Estimation
• Toward Multimodal Image-to-Image Translation
• Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural Networks
• Stealing Machine Learning Models via Prediction APIs
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• SampleRNN: An Unconditional End-to-End Neural Audio Generation Model
• Generating Multi-label Discrete Patient Records using Generative Adversarial Networks
• Differentially Private Generative Adversarial Network
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Generalization and Equilibrium in Generative Adversarial Nets (GANs)
• Non-Stationary Texture Synthesis by Adversarial Expansion
• Understanding Membership Inferences on Well-Generalized Learning Models
• White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
• Privacy-Protective-GAN for Face De-identification
• AttGAN: Facial Attribute Editing by Only Changing What You Want
• MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples
• GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators
• Accurate and Diverse Sampling of Sequences based on a "Best of Many" Sample Objective
• walk2friends: Inferring Social Links from Mobility Profiles
• Image Processing Using Multi-Code GAN Prior

Cited by in corpus (43)

• A Survey of Privacy Attacks in Machine Learning
• When Machine Unlearning Jeopardizes Privacy
• FedDPGAN: Federated Differentially Private Generative Adversarial Networks Framework for the Detection of COVID-19 Pneumonia
• Adversarial Attacks Against Deep Generative Models on Data: A Survey
• Node-Level Membership Inference Attacks Against Graph Neural Networks
• DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation
• ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models
• Unveiling Memorization in Code Models
• Debiasing Learning for Membership Inference Attacks Against Recommender Systems
• Differentially Private Synthetic Data: Applied Evaluations and Enhancements
• Modelling and Quantifying Membership Information Leakage in Machine Learning
• Knowledge Cross-Distillation for Membership Privacy
• Membership Inference on Word Embedding and Beyond
• Synthetic Observational Health Data with GANs: from slow adoption to a boom in medical research and ultimately digital twins?
• Bounding Information Leakage in Machine Learning
• privGAN: Protecting GANs from membership inference attacks at low cost
• Robin Hood and Matthew Effects: Differential Privacy Has Disparate Impact on Synthetic Data
• DTGAN: Differential Private Training for Tabular GANs
• Generative Synthesis of Insurance Datasets
• Membership Inference Attacks Against Recommender Systems
• MACE: A Flexible Framework for Membership Privacy Estimation in Generative Models
• DAMIA: Leveraging Domain Adaptation as a Defense against Membership Inference Attacks
• NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attacks
• SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systems
• On the Privacy Risks of Cell-Based NAS Architectures
• Quantifying and Mitigating Privacy Risks of Contrastive Learning
• Differentially Private Synthetic Data Generation Using Context-Aware GANs
• Data and Model Dependencies of Membership Inference Attack
• Exploiting Defenses against GAN-Based Feature Inference Attacks in Federated Learning
• Improving Robustness using Generated Data
• Model Extraction and Defenses on Generative Adversarial Networks
• PATE-AAE: Incorporating Adversarial Autoencoder into Private Aggregation of Teacher Ensembles for Spoken Command Classification
• A Deep Learning Approach to Private Data Sharing of Medical Images Using Conditional GANs
• Effective and Privacy preserving Tabular Data Synthesizing
• Teacher Model Fingerprinting Attacks Against Transfer Learning
• Unlearning Inversion Attacks for Graph Neural Networks
• 10 Security and Privacy Problems in Large Foundation Models
• A Tandem Framework Balancing Privacy and Security for Voice User Interfaces
• TableGAN-MCA: Evaluating Membership Collisions of GAN-Synthesized Tabular Data Releasing
• A Differentially Private Multi-Output Deep Generative Networks Approach For Activity Diary Synthesis
• DP-SGD vs PATE: Which Has Less Disparate Impact on GANs?
• Machine Learning in Epidemiology
• Causally Constrained Data Synthesis for Private Data Release