The ISC International Journal of Information Security

Abstract Generative Adversarial Networks (GANs) are commonly used in various applications. Different membership inference attacks have been carried out against GANs. However, the accuracy of these attacks decreases with a large number of training samples, and there have been no attacks conducted against privacy-preserving GAN models with dependent or independent datasets. Therefore, this paper proposes a fine-grained inversion-based attack. In this proposed attack, fine-grained reconstruction error is utilized to infer the membership or non-membership of given samples. To calculate the
reconstruction error, an inversion-based encoder is trained, and the latent code obtained from the encoder is refined using a Genetic Algorithm. The membership status of the candidate target sample is determined using the reconstruction error of the segmentations of the target sample. The proposed attack can be executed by accessing the generator network in both black and white-box settings. The accuracy of the proposed attack is compared with other relevant studies, demonstrating its superior performance. Furthermore, the results indicate that privacy-preserving mechanisms do not ensure that dependent data does not disclose information about individual samples.

Abstract In the realm of machine learning, Generative Adversarial Networks (GANs) have revolutionized the generation of synthetic data, closely mirroring the distribution of real datasets. This paper delves into the privacy concerns associated with GANs, particularly focusing on Membership Inference Attacks (MIAs), which aim to determine if a specific record was used in training a model. Such attacks pose significant privacy risks, especially when sensitive data is involved. To combat this, we propose a novel detector model designed to identify and thwart MIAs within GANs. Our model, which operates as an additional layer of protection for Machine Learning as a Service (MLaaS) providers, leverages outputs from both the discriminator and generator to ascertain the membership status of data samples. We introduce two variants of the detector model—supervised and unsupervised—based on the availability of information from the discriminator. The supervised detector employs labeled data for training, while the unsupervised detector uses anomaly detection techniques. Our experimental evaluation spans various GAN architectures and datasets, ensuring the robustness and generalizability of our approach. The paper also analyzes the impact of dataset size on the detector's effectiveness. By integrating our detector, MLaaS providers can enhance privacy safeguards, striking a balance between model utility and data protection.

Abstract Using generative models to produce unlimited synthetic samples is a popular replacement for database sharing. Generative Adversarial Network (GAN) is a popular class of generative models which generates synthetic data samples very similar to real training datasets. However, GAN models do not necessarily guarantee training privacy as these models may memorize details of training data samples. When these models are built using sensitive data, the developers should ensure that the training dataset is appropriately protected against privacy leakage. Hence, quantifying the privacy risk of these models is essential. To this end, this paper focuses on evaluating the privacy risk of publishing the generator network of GAN models. Specially, we conduct a novel generator white-box membership inference attack against GAN models that exploits accessible information about the victim model, i.e., the generator’s weights and synthetic samples, to conduct the attack. In the proposed attack, an auto-encoder is trained to determine member and non-member training records. This attack is applied to various kinds of GANs. We evaluate our attack accuracy with respect to various model types and training configurations. The results demonstrate the superior performance of the proposed attack on non-private GANs compared to previous attacks in white-box generator access. The accuracy of the proposed attack is 19% higher on average than similar work. The proposed attack, like previous attacks, has better performance for victim models that are trained with small training sets.