Adversarial Attacks Against Deep Generative Models on Data: A Survey

Abstract

Deep generative models have gained much attention given their ability to generate data for applications as varied as healthcare to financial technology to surveillance, and many more - the most popular models being generative adversarial networks and variational auto-encoders. Yet, as with all machine learning models, ever is the concern over security breaches and privacy leaks and deep generative models are no exception. These models have advanced so rapidly in recent years that work on their security is still in its infancy. In an attempt to audit the current and future threats against these models, and to provide a roadmap for defense preparations in the short term, we prepared this comprehensive and specialized survey on the security and privacy preservation of GANs and VAEs. Our focus is on the inner connection between attacks and model architectures and, more specifically, on five components of deep generative models: the training data, the latent code, the generators/decoders of GANs/ VAEs, the discriminators/encoders of GANs/ VAEs, and the generated data. For each model, component and attack, we review the current research progress and identify the key challenges. The paper concludes with a discussion of possible future attacks and research directions in the field.

arXiv commentTo be published in IEEE Transactions on Knowledge and Data Engineering

References in corpus (43)

• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• A Survey on Deep Learning in Medical Image Analysis
• Auto-Encoding Variational Bayes
• Conditional Generative Adversarial Nets
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Deep learning in agriculture: A survey
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• The Effectiveness of Data Augmentation in Image Classification using Deep Learning
• Renyi Differential Privacy
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural Networks
• Evasion Attacks against Machine Learning at Test Time
• Generating Videos with Scene Dynamics
• Poisoning Attacks against Support Vector Machines
• Deep Text Classification Can be Fooled
• Spectral Signatures in Backdoor Attacks
• Generating Multi-label Discrete Patient Records using Generative Adversarial Networks
• Differentially Private Generative Adversarial Network
• GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
• MD-GAN: Multi-Discriminator Generative Adversarial Networks for Distributed Datasets
• Towards the Science of Security and Privacy in Machine Learning
• More Than Privacy: Applying Differential Privacy in Key Areas of Artificial Intelligence
• Deep Learning on Graphs: A Survey
• Generative Poisoning Attack Method Against Neural Networks
• DPatch: An Adversarial Patch Attack on Object Detectors
• A General Approach to Adding Differential Privacy to Iterative Training Procedures
• When Machine Learning Meets Privacy: A Survey and Outlook
• Adversarial Images for Variational Autoencoders
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• FedGAN: Federated Generative Adversarial Networks for Distributed Data
• Object Hider: Adversarial Patch Attack Against Object Detectors
• Adversarial Attacks on Variational Autoencoders
• BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models
• Fidelity and Privacy of Synthetic Medical Data
• Enabling Fast Differentially Private SGD via Just-in-Time Compilation and Vectorization
• Creative GANs for generating poems, lyrics, and metaphors
• Training Federated GANs with Theoretical Guarantees: A Universal Aggregation Approach
• Federated AI lets a team imagine together: Federated Learning of GANs
• Model Extraction and Defenses on Generative Adversarial Networks
• Double Backpropagation for Training Autoencoders against Adversarial Attack
• Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack

Cited by in corpus (1)

• Sharing is CAIRing: Characterizing Principles and Assessing Properties of Universal Privacy Evaluation for Synthetic Tabular Data