This Person (Probably) Exists. Identity Membership Attacks Against GAN Generated Faces

Abstract

Recently, generative adversarial networks (GANs) have achieved stunning realism, fooling even human observers. Indeed, the popular tongue-in-cheek website {\small \url{ http://thispersondoesnotexist.com}}, taunts users with GAN generated images that seem too real to believe. On the other hand, GANs do leak information about their training data, as evidenced by membership attacks recently demonstrated in the literature. In this work, we challenge the assumption that GAN faces really are novel creations, by constructing a successful membership attack of a new kind. Unlike previous works, our attack can accurately discern samples sharing the same identity as training samples without being the same samples. We demonstrate the interest of our attack across several popular face datasets and GAN training procedures. Notably, we show that even in the presence of significant dataset diversity, an over represented person can pose a privacy concern.

References in corpus (9)

• Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks
• GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
• Deep Face Recognition: A Survey
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Differentially Private Generative Adversarial Network
• Generalization and Equilibrium in Generative Adversarial Nets (GANs)
• Assessing Generative Models via Precision and Recall
• White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
• Performing Co-Membership Attacks Against Deep Generative Models

Cited by in corpus (5)

• Does CLIP Know My Face?
• LATENTPATCH: A Non-Parametric Approach for Face Generation and Editing
• Don't Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergence
• Self-supervised denoising for massive noisy images
• MixSyn: Learning Composition and Style for Multi-Source Image Synthesis