LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks

By Jamie Hayes, Luca Melis, George Danezis, Emiliano De Cristofaro. 2017

107 citations recorded by the source corpus.

Generative models are increasingly used to artificially generate various kinds of data, including high-quality images and videos. These models are used to estimate the underlying distribution of a dataset and randomly generate realistic samples according to their estimated distribution. However, the data used to train these models is often sensitive, thus prompting the need to evaluate information leakage from producing synthetic samples with generative models---specifically, whether an adversary can infer information about the data used to train the models. In this paper, we present the first membership inference attack on generative models. To mount the attack, we train a Generative Adversarial Network (GAN), which combines a discriminative and a generative model, to detect overfitting and recognize inputs that are part of training datasets by relying on the discriminator's capacity to learn statistical differences in distributions. We present attacks based on both white-box and black-box access to the target model, and show how to improve the latter using limited auxiliary knowledge of dataset samples. We test our attacks on several state-of-the-art models, such as Deep Convolutional GAN (DCGAN), Boundary Equilibrium GAN (BEGAN), and the combination of DCGAN with a Variational Autoencoder (DCGAN+VAE), using datasets consisting of complex representations of faces (LFW), objects (CIFAR-10), and medical images (Diabetic Retinopathy). The white-box attacks are 100% successful at inferring which samples were used to train the target model, and the black-box ones succeeds with 80% accuracy. Finally, we discuss the sensitivity of our attacks to different training parameters, and their robustness against mitigation strategies, finding that successful defenses often result in significant worse performances of the generative models in terms of training stability and/or sample quality.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks (2018, background): “Membership inference attacks have seen further study, including examining why membership inference is possible [49], or mounting inference attacks on other forms of generative models [22].”
Privacy in Deep Learning: A Survey (2020, background): “Inference Parameter Inference Property Inference Access to Model Access to Model Output Membership Inference [13] # # # # Blackbox Logits Measuring Membership Privacy[35] # # # # Blackbox Logits ML-Leaks[36] # # # # Blackbox Logits The Natural Auditor [37] # # # # Blackbox Label LOGAN [38] # # # # B”
Comprehensive Privacy Analysis of Deep Learning: Stand-alone and Federated Learning under Passive and Active White-box Inference Attacks (2018, background): “Hayes et al. [19] used generative adversarial networks to perform membership attacks on generative models.”
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, methodology): “[18] use generative adversarial networks to perform membership inference attacks against generative models.”
Knock Knock, Who's There? Membership Inference on Aggregate Location Data (2017, background): “[13] focus on privacy leakage from generative models in Machine Learning as a Service applications.”
Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning (2018, methodology): “The membership attack [6], [17], [18] is to decide whether a given sample belongs to the training dataset.”
Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning (2018, neutral): “[18] used generative adversarial networks to perform membership attacks on generative models.”
SoK: Security and Privacy in Machine Learning (2018, background): “White-Box Full No [42], [43], [44] [24], [21], [44], [45], [46] [47] [48]”
Demystifying Membership Inference Attacks in Machine Learning as a Service (2019, unknown): “ence [8], [9], [10], [7] have been focused on deep learning models.”
The Natural Auditor: How To Tell If Someone Used Your Words To Train Their Model (2018, methodology): “[13] studied membership inference attacks against generative models.”
Towards Demystifying Membership Inference Attacks (2018, background): “Most existing membership inference attacks similarly attack deep learning models, utilizing deep neural networks (DNNs) for training both the target model under attack and the attack model [6, 18, 28, 41].”
A Framework for Evaluating Gradient Leakage Attacks in Federated Learning (2020, background): “Privacy exploits at the prediction phase include model inversion, membership inference, and GAN-based reconstruction attack [13,14,38].”
Inference Attacks Against Collaborative Learning (2018, background): “[23] focus on generative models in machinelearning-as-a-service applications and train GANs [21] to detect overfitting and recognize training inputs.”
MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples (2019, result): “While most of the previous works concentrated on classification models [33, 34, 42, 43, 56, 58, 69], Hayes et al. [21] studied membership inference against generative models, in particular generative adversarial networks (GANs) [18].”
GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models (2019, methodology): “GAN models inevitably underrepresent certain data samples, i.e., encounter mode dropping and mode collapse, which pose additional difficulty to the attacker. Unfortunately, none of the existing works [25, 29] provides a generic attack applicable to varying types of generative models. Nor dotheyrepor”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, background): “Recently, several other attacks have been proposed [19, 39, 49].”
Attributing Fake Images to GANs: Analyzing Fingerprints in Generated Images (2018, background): “There have been first progress to formulate membership inference attacks against generative models too [12].”
Dynamic Backdoor Attacks Against Machine Learning Models (2020, background): “Beside the above, there are multiple other types of attacks against machine learning models, such as membership inference [39], [16], [13], [34], [35], [24], [14], [25], [50],”
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning (2019, background): “More recently, multiple membership inference attacks have been proposed with new attacking techniques or targeting on different types of ML models [19, 27, 28, 31, 32, 38, 42, 53].”