GANobfuscator: Mitigating Information Leakage Under GAN via Differential Privacy

By Chugui Xu, Ju Ren, Deyu Zhang, Yaoxue Zhang, Zhan Qin, Kui Ren. 2019

209 citations recorded by the source corpus.

By learning generative models of semantic-rich data distributions from samples, generative adversarial network (GAN) has recently attracted intensive research interests due to its excellent empirical performance as a generative model. The model is used to estimate the underlying distribution of a dataset and randomly generate realistic samples according to their estimated distribution. However, GANs can easily remember training samples due to the high model complexity of deep networks. When GANs are applied to private or sensitive data, the concentration of distribution may divulge some critical information. It consequently requires new technological advances to mitigate the information leakage under GANs. To address this issue, we propose GANobfuscator, a differentially private GAN, which can achieve differential privacy under GANs by adding carefully designed noise to gradients during the learning procedure. With GANobfuscator, analysts are able to generate an unlimited amount of synthetic data for arbitrary analysis tasks without disclosing the privacy of training data. Moreover, we theoretically prove that GANobfuscator can provide strict privacy guarantee with differential privacy. In addition, we develop a gradient-pruning strategy for GANobfuscator to improve the scalability and stability of data training. Through extensive experimental evaluation on benchmark datasets, we demonstrate that GANobfuscator can produce high-quality generated data and retain desirable utility under practical privacy budgets.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

This Face Does Not Exist... But It Might Be Yours! Identity Leakage in Generative Models (2020, background): “Xu et al.[28] offer GANobfuscator as a solution to the problem of data leakage in GANs.”
NoPeek: Information leakage reduction to share activations in distributed deep learning (2020, background): “theoretic loss based privacy: These can be categorized into hiding specific sensitive attributes using adversarial training that reaches an equilibrium based on information theoretic loss functions optimized under minimax settings through learning weights of deep learning models [29, 30, 31, 32, 33,”
Copyright in generative deep learning (2021, unknown): “…can be found in Padilla-López et al. (2015); the use of differential privacy (Dwork and Roth, 2014) has opened a new field of research (Liu et al., 2019; Wu et al., 2019; Xu et al., 2019; etc.), but also privacy in clinical data sharing is considered (see, e.g., Beaulieu-Jones et al., 2019).”
Private FL-GAN: Differential Privacy Synthetic Data Generation Based on Federated Learning (2020, background): “Later, Xu et al. developed GANobfuscator with a precision-designed gradient pruning strategy in [14], achieving high-quality synthetic data generation.”
Membership Inference Attacks on Machine Learning: A Survey (2021, background): “Many papers [8, 27, 148, 198, 217, 220, 222, 240] have proposed various differentially private generative models to ensure the privacy of their training records.”
Machine Learning for Synthetic Data Generation: a Review (2023, background): “While most of these approaches inject noise into the energy function, a differentially private GAN called GANobfuscator [172] achieve differential privacy by adding noise within the training procedure.”
Locally Differentially Private Data Collection and Analysis (2019, background): “One of the many topics in DP research is differentially private empirical risk minimization for machine learning [18, 10], especially for deep neural networks [1, 40, 59, 2, 53].”
DarkneTZ: towards model privacy at the edge using trusted execution environments (2020, methodology): “ect the utility (i.e., the prediction accuracy) if the noise is not carefully designed [45]. In order to obfuscate private information only, one could apply methods such as generative neural networks [54] or adversarial examples [29] to craft noises for one particular data record (e.g., one image), ”
Blockchain Empowered Asynchronous Federated Learning for Secure Data Sharing in Internet of Vehicles (2020, background): “over, conventional centralized AI algorithms may incur various security issues such as information leakage [36] and privacy attacks.”