Abstract:Generative Adversarial Networks (GANs) have been widely used for generating synthetic data for cases where there is a limited size real-world dataset or when data holders are unwilling to share their data samples. Recent works showed that GANs, due to overfitting and memorization, might leak information regarding their training data samples. This makes GANs vulnerable to Membership Inference Attacks (MIAs). Several defense strategies have been proposed in the literature to mitigate this privacy issue. Unfortunately, defense strategies based on differential privacy are proven to reduce extensively the quality of the synthetic data points. On the other hand, more recent frameworks such as PrivGAN and PAR-GAN are not suitable for small-size training datasets. In the present work, the overfitting in GANs is studied in terms of the discriminator, and a more general measure of overfitting based on the Bhattacharyya coefficient is defined. Then, inspired by Fano's inequality, our first defense mechanism against MIAs is proposed. This framework, which requires only a simple modification in the loss function of GANs, is referred to as the maximum entropy GAN or MEGAN and significantly improves the robustness of GANs to MIAs. As a second defense strategy, a more heuristic model based on minimizing the information leaked from generated samples about the training data points is presented. This approach is referred to as mutual information minimization GAN (MIMGAN) and uses a variational representation of the mutual information to minimize the information that a synthetic sample might leak about the whole training data set. Applying the proposed frameworks to some commonly used data sets against state-of-the-art MIAs reveals that the proposed methods can reduce the accuracy of the adversaries to the level of random guessing accuracy with a small reduction in the quality of the synthetic data samples.

Mixup Training for Generative Models to Defend Membership Inference Attacks.

NetGuard: Protecting Commercial Web APIs from Model Inversion Attacks Using GAN-generated Fake Samples

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

A GAN-Based Defense Framework Against Model Inversion Attacks.

Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks.

Model Inversion Attacks Through Target-Specific Conditional Diffusion Models

GANMIA: GAN-based Black-box Membership Inference Attack

Regularization Mixup Adversarial Training: A Defense Strategy for Membership Privacy with Model Availability Assurance

Preserving Privacy in GANs Against Membership Inference Attack

A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Models

Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models

Defending Against Membership Inference Attack by Shielding Membership Signals

PAR-GAN: Improving the Generalization of Generative Adversarial Networks Against Membership Inference Attacks

Pseudo Label-Guided Model Inversion Attack Via Conditional Generative Adversarial Network.

A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks

Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shift

Rethinking Mixup for Improving the Adversarial Transferability

Membership Inference Attacks and Defenses in Classification Models

White-box Membership Inference Attacks against Diffusion Models

TableGAN-MCA: Evaluating Membership Collisions of GAN-Synthesized Tabular Data Releasing

Model Inversion Attack via Dynamic Memory Learning