LOGAN: Membership Inference Attacks Against Generative Models

By Jamie Hayes, Luca Melis, George Danezis, Emiliano De Cristofaro. 2017

600 citations recorded by the source corpus.

Abstract Generative models estimate the underlying distribution of a dataset to generate realistic samples according to that distribution. In this paper, we present the first membership inference attacks against generative models: given a data point, the adversary determines whether or not it was used to train the model. Our attacks leverage Generative Adversarial Networks (GANs), which combine a discriminative and a generative model, to detect overfitting and recognize inputs that were part of training datasets, using the discriminator’s capacity to learn statistical differences in distributions. We present attacks based on both white-box and black-box access to the target model, against several state-of-the-art generative models, over datasets of complex representations of faces (LFW), objects (CIFAR-10), and medical images (Diabetic Retinopathy). We also discuss the sensitivity of the attacks to different training parameters, and their robustness against mitigation strategies, finding that defenses are either ineffective or lead to significantly worse performances of the generative models in terms of training stability and/or sample quality.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Generative Models, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Generative Models

In Privacy & Security

Citations in the corpus

Generative Models for Effective ML on Private, Decentralized Datasets (2019, methodology): “Further, while often unrealistic as a threat model, membership inference attacks on GANs can also be used as a tool to empirically quantify memorization (Hayes et al., 2019; Hilprecht et al., 2019).”
Theoretical Guarantees for Model Auditing with Finite Adversaries (2019, methodology): “Further, while often unrealistic as a threat model, black-box and white-box membership inference attacks can also be used as a tool to empirically quantify memorization [6,14,15].”
Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, background): “For a target machine learning model, the membership inference attacks aim to determine whether a given data point was used to train the model or not [18, 32, 37, 41, 47, 64].”
Exploiting Unintended Feature Leakage in Collaborative Learning (2018, background): “[24] focus on generative models in machine-learning-as-a-service applications and train GANs [22] to detect overfitting and recognize training inputs.”
Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer (2019, methodology): “Co-distillation approach is a method to use distillation on private training data with other parties [7], [28], however, without defending against data poisoning and inference attacks [48], [56], [22].”
Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks (2019, background): “Membership attacks [28, 15, 24, 14, 26] attempt to determine whether a particular cohort of data was used for training, without any constructive indication on how to actively forget it.”
Auditing Data Provenance in Text-Generation Models (2018, neutral): “[11] study membership inference against generative models.”
Information Leakage in Embedding Models (2020, background): “bershipinferenceandmemorization. Membership inference attacks (MIA) have first been studied against black-box supervised classification models [66], and later on generative models and language models [23, 67]. MIA is closely connected to generalization where overfitted models are prone to the attack”
A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly (2023, background): “In this section, we examine the range of existing defense methods against various attacks and vulnerabilities associated with LLMs 1 .”
Label-Only Membership Inference Attacks (2020, background): “Thus, in contrast to prior research [7, 12, 13, 14], our attacks can be mounted against any machine learning service, regardless of the granularity of the provided query interface.”
Synthesis of Realistic ECG using Generative Adversarial Networks (2019, background): “Conversely, Hayes et al. (2018) carried out membership inference attacks on synthetic images and concluded that by improving the GAN’s ability to minimise privacy risks, the quality of the data generated is sacriﬁced [38].”
Generative Adversarial Networks in Time Series: A Systematic Literature Review (2022, background): “Hayes et al. [48] carried out membership inference attacks on synthetic images and concluded that for acceptable levels of privacy in the GAN, the quality of the data generated is sacrificed.”
Machine Learning for Synthetic Data Generation: a Review (2023, background): “By repeatedly sampling from the distribution, there is a considerable chance of recovering the training samples [161]–[163] or the membership of the training data [164].”
Eavesdrop the Composition Proportion of Training Labels in Federated Learning (2019, background): “The former one assumes that the attacker compromises some participated devices and uses them to achieve malicious intentions, e.g. importing backdoor to FL [14, 15], adversarial poisoning [16, 17, 18], membership or property inference [19, 20, 21, 22], and reconstruction attack [23, 24, 25].”