The ISC International Journal of Information Security

Abstract Generative Adversarial Networks (GANs) are commonly used in various applications. Different membership inference attacks have been carried out against GANs. However, the accuracy of these attacks decreases with a large number of training samples, and there have been no attacks conducted against privacy-preserving GAN models with dependent or independent datasets. Therefore, this paper proposes a fine-grained inversion-based attack. In this proposed attack, fine-grained reconstruction error is utilized to infer the membership or non-membership of given samples. To calculate the
reconstruction error, an inversion-based encoder is trained, and the latent code obtained from the encoder is refined using a Genetic Algorithm. The membership status of the candidate target sample is determined using the reconstruction error of the segmentations of the target sample. The proposed attack can be executed by accessing the generator network in both black and white-box settings. The accuracy of the proposed attack is compared with other relevant studies, demonstrating its superior performance. Furthermore, the results indicate that privacy-preserving mechanisms do not ensure that dependent data does not disclose information about individual samples.

Abstract Using generative models to produce unlimited synthetic samples is a popular replacement for database sharing. Generative Adversarial Network (GAN) is a popular class of generative models which generates synthetic data samples very similar to real training datasets. However, GAN models do not necessarily guarantee training privacy as these models may memorize details of training data samples. When these models are built using sensitive data, the developers should ensure that the training dataset is appropriately protected against privacy leakage. Hence, quantifying the privacy risk of these models is essential. To this end, this paper focuses on evaluating the privacy risk of publishing the generator network of GAN models. Specially, we conduct a novel generator white-box membership inference attack against GAN models that exploits accessible information about the victim model, i.e., the generator’s weights and synthetic samples, to conduct the attack. In the proposed attack, an auto-encoder is trained to determine member and non-member training records. This attack is applied to various kinds of GANs. We evaluate our attack accuracy with respect to various model types and training configurations. The results demonstrate the superior performance of the proposed attack on non-private GANs compared to previous attacks in white-box generator access. The accuracy of the proposed attack is 19% higher on average than similar work. The proposed attack, like previous attacks, has better performance for victim models that are trained with small training sets.