Abstract:Generative Adversarial Networks (GANs) do not ensure the privacy of the training datasets and may memorize sensitive details. To maintain privacy of data during inference, various privacy-preserving GAN mechanisms have been proposed. Despite the different approaches and their characteristics, advantages, and disadvantages, there is a lack of a systematic review on them. This paper first presents a comprehensive survey on privacy-preserving mechanisms and offers a taxonomy based on their characteristics. The survey reveals that many of these mechanisms modify the GAN learning algorithm to enhance privacy, highlighting the need for theoretical and empirical analysis of the impact of these modifications on GAN convergence. Among the surveyed methods, ADAM-DPGAN is a promising approach that ensures differential privacy in GANs for both the discriminator and the generator networks when using the ADAM optimizer, by introducing appropriate noise based on the global sensitivity of discriminator parameters. Therefore, this paper conducts a theoretical and empirical analysis of the convergence of ADAM-DPGAN. In the presented theoretical analysis, assuming that simultaneous/alternating gradient descent method with ADAM optimizer converges locally to a fixed point and its operator is L-Lipschitz with L < 1, the effect of ADAM-DPGAN-based noise disturbance on local convergence is investigated and an upper bound for the convergence rate is provided. The analysis highlights the significant impact of differential privacy parameters, the number of training iterations, the discriminator's learning rate, and the ADAM hyper-parameters on the convergence rate. The theoretical analysis is further validated through empirical analysis. Both theoretical and empirical analyses reveal that a stronger privacy guarantee leads to a slower convergence, highlighting the trade-off between privacy and performance. The findings also indicate that there exists an optimal value for the number of training iterations regarding the privacy needs. The optimal settings for each parameter are calculated and outlined in the paper.

Private GANs, Revisited

PKDGAN: Private Knowledge Distillation with Generative Adversarial Networks

Private Post-GAN Boosting

Private Knowledge Transfer via Model Distillation with Generative Adversarial Networks

Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection.

On the local convergence of ADAM-DPGAN with simultaneous and alternating gradient decent training methods

Differentially Private Generative Adversarial Network

RDP-GAN: A Rényi-Differential Privacy Based Generative Adversarial Network

Privacy-enhanced generative adversarial network with adaptive noise allocation

Improving GANs with A Dynamic Discriminator

GANobfuscator: Mitigating Information Leakage under GAN Via Differential Privacy

From private to public: benchmarking GANs in the context of private time series classification

DP-SGD vs PATE: Which Has Less Disparate Impact on GANs?

PATE-TripleGAN: Privacy-Preserving Image Synthesis with Gaussian Differential Privacy

Training generative models from privatized data

PPGAN: Privacy-preserving Generative Adversarial Network

Large-Scale Public Data Improves Differentially Private Image Generation Quality

Stop Throwing Away Discriminators! Re-using Adversaries for Test-Time Training

Addressing GAN Training Instabilities via Tunable Classification Losses

Privacy and distribution preserving generative adversarial networks with sample balancing

The Elusive Pursuit of Replicating PATE-GAN: Benchmarking, Auditing, Debugging