GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models

By Dingfan Chen, Ning Yu, Yang Zhang, Mario Fritz. 2019

514 citations recorded by the source corpus.

Deep learning has achieved overwhelming success, spanning from discriminative models to generative models. In particular, deep generative models have facilitated a new level of performance in a myriad of areas, ranging from media manipulation to sanitized dataset generation. Despite the great success, the potential risks of privacy breach caused by generative models have not been analyzed systematically. In this paper, we focus on membership inference attack against deep generative models that reveals information about the training data used for victim models. Specifically, we present the first taxonomy of membership inference attacks, encompassing not only existing attacks but also our novel ones. In addition, we propose the first generic attack model that can be instantiated in a large range of settings and is applicable to various kinds of deep generative models. Moreover, we provide a theoretically grounded attack calibration technique, which consistently boosts the attack performance in all cases, across different attack settings, data modalities, and training configurations. We complement the systematic analysis of attack performance by a comprehensive experimental study, that investigates the effectiveness of various attacks w.r.t. model type and training configurations, over three diverse application scenarios (i.e., images, medical data, and location data).

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Generative Models for Effective ML on Private, Decentralized Datasets (2019, methodology): “Further, while often unrealistic as a threat model, membership inference attacks on GANs can also be used as a tool to empirically quantify memorization (Hayes et al., 2019; Hilprecht et al., 2019).”
Contamination Attacks and Mitigation in Multi-Party Machine Learning (2018, background): “In multi-party machine learning, given a training record, predicting which party it belongs to is a form of a membership inference attack and has real privacy concerns (see [17, 25, 40]).”
Auditing Data Provenance in Text-Generation Models (2018, background): “Hayes et al. [11] study membership inference against generative models.”
Membership Inference Attacks against Generative Models with Probabilistic Fluctuation (unknown): “However, existing proxies either rely on massive synthetic records [ van Breugel et al. , 2023 ] or are only applicable in white-box settings [ Chen et al. , 2020 ] .”
When Machine Unlearning Jeopardizes Privacy (2020, background): “Since then, membership inference has been extensively investigated in various ML models and tasks, such as federated learning [46], white-box classification [48], generative adversarial networks [13, 28], natural language processing [67], and computer vision segmentation [30].”
Machine unlearning: linear filtration for logit-based classifiers (2020, background): “A few recent works on membership inference include (Shokri et al., 2017; Yeom et al., 2018; Hayes et al., 2019; Sablayrolles et al., 2019).”
Improving Robustness using Generated Data (2021, background): “The underlying generative models may leak conﬁdential and private data [13] if they have been trained on a separate dataset.”
Membership Inference Attacks on Machine Learning: A Survey (2021, background): “Chen et al. [21] propose a generic MIA on generative models that is applicable to all adversarial knowledge settings, from full black-box to full white-box settings.”
Large Language Models Can Be Strong Differentially Private Learners (2021, background): “Machine learning systems trained on sensitive user data can be vulnerable to privacy attacks (Shokri et al., 2017; Hayes et al., 2019).”
TabDDPM: Modelling Tabular Data with Diffusion Models (2022, methodology): “In addition, following (Chen et al., 2020a; Lee et al., 2021), we measure a success rate of a full black-box privacy attack (see Table 6).”
Dynamic Backdoor Attacks Against Machine Learning Models (2020, background): “Beside the above, there are multiple other types of attacks against machine learning models [26], such as membership inference [6], [15]–[17], [29], [31], [42], [46], [48], [60], model stealing [35], [45], [52], [54], model inversion [9], [10], [18], property inference [11], [30], [63], and dataset ”
Machine Learning for Synthetic Data Generation: a Review (2023, background): “By repeatedly sampling from the distribution, there is a considerable chance of recovering the training samples [161]–[163] or the membership of the training data [164].”