GAN-Leaks: A taxonomy of membership inference attacks against generative models

1. 01What problem does this paper attempt to solve?

   A systematic study of membership inference attacks against deep generative models: establishing a taxonomy of attack settings and proposing a general attack method applicable to each setting.

   Core question: how to systematically mount and evaluate membership inference attacks (MIA) against deep generative models (GAN, VAE), i.e., inferring whether a given record was used to train the victim generative model.

   • Scenario and importance: the authors note that GANs have been used for health record and medical image synthesis, and membership itself may leak a patient's medical history; privacy-preserving data sharing efforts also rely on GANs to release de-identified data, so membership privacy leakage needs to be quantified under realistic threat models.
   • Shortcomings of existing methods: the authors state that Hayes et al. [25] did not consider the realistic case where the discriminator is inaccessible and only the generator is released; Hilprecht et al. [29] experimented only on small-scale image datasets and does not involve white-box attacks on GANs; neither provides a general attack applicable to multiple types of generative models.
   • Core observation and assumption: the training objective of generative models is to approximate the training data distribution, so the authors assume that the membership probability of a query sample is proportional to the probability that it can be generated by the victim generator (Equation 2), which can be approximated by reconstruction error.
   • Contributions of the paper: the authors propose a taxonomy of attack settings (Table 1, Figure 1), a general reconstruction-based attack model and its instantiated variants under three settings, a theoretically near-Bayes-optimal attack calibration technique, and conduct systematic experiments on three data modalities.
   • Threat model:
     • Goal: perform binary classification on a query sample to determine whether it belongs to the victim model's training set (Section 3.2).
     • Knowledge: in decreasing order of knowledge, accessible discriminator (full model), white-box generator, partial black-box generator (the latent code of each generated sample is visible), full black-box generator (can only collect generated samples) (Section 4).
     • Capability: under full black-box the attacker is passive and cannot control the input; partial black-box can manipulate the latent code; white-box can access the generator's internals and gradients.
     • Victim system: a deep generative model released after training, in the experiments five GAN-type models and VAE.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three categories: MIA against discriminative models, MIA against generative models (LOGAN, MC), and differential privacy defenses.

   Membership inference attacks against discriminative models

   • Shokri et al. [60] — proposed the first black-box MIA against discriminative models: train shadow models to imitate the victim model's behavior, use their outputs to train an attack model, and the attacker can obtain confidence scores for all classes.
   • The authors also cite a body of MIA work against discriminative models, including ML-Leaks [58], Yeom et al. [68], Nasr et al. [51], as a contrast showing that this direction has already received attention.

   Membership inference attacks against generative models

   • Hayes et al. [25] (LOGAN) — a black-box MIA against GANs: retrain a shadow copy of the victim model, and threshold the discriminator's output score on the query input to decide membership; the paper criticizes it for not considering the realistic case where the discriminator is inaccessible.
   • Hilprecht et al. [29] (MC) — for VAEs, assumes access to the full model and thresholds the L2 reconstruction error; for GANs, considers only full black-box, counting the number of generated samples falling within the 𝜖-ball of the query sample; the paper criticizes it for experimenting only on small-scale image datasets and not addressing white-box attacks on GANs.

   Differential privacy (DP) defenses

   • Dwork et al.'s differential privacy [17] and DP-SGD [1] — protect membership privacy by injecting calibrated noise into training gradients.
   • A body of work [2, 7, 11, 35, 66, 73] uses DP to constrain GAN training and releases DP models in place of raw data; this paper evaluates DP-SGD in defense experiments.

   Baselines and benchmarks: the comparison baselines are LOGAN [25] (full black-box and accessible discriminator settings) and MC [29] (full black-box); the experimental datasets are CelebA, MIMIC-III, and Instagram New-York.

   The authors position this paper as: establishing a taxonomy covering existing and new attacks, and proposing the first general attack model that can be instantiated in each setting and applies to multiple classes of deep generative models (the authors state that the partial black-box and white-box settings are new settings unexplored by prior work).

   Collapse this answer

3. 03How does the paper address this problem?

   Approximate "the probability that a sample can be generated by the victim generator" with reconstruction error, compute the reconstruction by nearest neighbor or optimization according to the amount of attacker knowledge, and then use a reference model for per-sample calibration.

   Overall idea: assume the membership probability is proportional to the probability that a query sample can be generated by the victim generator, approximate this probability with the sample's reconstruction error, and compute the optimal reconstruction in different ways according to the amount of attacker knowledge; then calibrate using the reconstruction error of an independent reference GAN.

   Problem formalization and taxonomy

   • The attack is formalized as binary classification: the attack model A takes as input a query sample x and the model release mechanism M(θ), and outputs a membership decision (Section 3.2); from a Bayesian perspective, the optimal attacker compares whether the log-likelihood ratio is non-negative (Equation 1).
   • The taxonomy divides settings by three criteria: whether the discriminator is accessible, whether the generator is accessible, and whether the latent code is accessible, yielding four settings (Table 1, Figure 1).

   General attack model

   • Core assumption: P(m_i=1|x_i, θ_v) ∝ P_Gv(x|θ_v), i.e., the membership probability is proportional to the probability that the sample is generated by the victim generator.
   • Since the generative distribution has no explicit density, this probability is estimated with a Parzen window, and it is noted that a few largest terms suffice for approximation (Equation 3–4).

   Instantiations under three settings

   • Full black-box: the attacker collects k generated samples and takes the one closest to the query sample as the reconstruction (Equation 5); k is set to the same order of magnitude as the training set, fixed at 20k in experiments (Appendix B.1).
   • Partial black-box: the attacker can see the latent code, performs gradient-free black-box optimization over z to minimize the reconstruction error, using Powell's Conjugate Direction Method with a maximum of 10 iterations (Appendix B.1).
   • White-box: the same reconstruction optimization, but gradients can be used, using L-BFGS with a maximum of 1000 iterations; the authors state it is robust to suboptimal initialization and converges faster.

   Distance metric

   • The distance consists of three terms: a pixel-level L2 term, a deep feature term LPIPS, and a latent code regularization term (Equation 8–10); for non-image data 𝜆2=0, and under full black-box 𝜆3=0.
   • For CelebA partial black-box and white-box attacks, 𝜆1=1.0, 𝜆2=0.2, 𝜆3=0.001; in other cases, 𝜆1=1.0, 𝜆2=0.0, 𝜆3=0.0 (Appendix B.1).

   Attack calibration

   • The authors observe that the reconstruction error depends on the difficulty of the query sample itself, so they independently train a reference GAN G_r on a related but disjoint dataset, and define the calibration error L_cal = L(x, R(x|G_v)) − L(x, R(x|G_r)).
   • Theorem 5.1 states that the membership probability can be approximated by a sigmoid of the calibration error, and that the optimal attack is equivalent to thresholding the calibration error at 𝜖 (proof in Appendix A); under white-box, the reference model has the same architecture as the victim model, while under black-box settings the reference model architecture is independent of the victim model and fixed.

   Success determination

   • The attack is a binary classification given a threshold 𝜖, and attack performance is evaluated by measuring AUCROC while varying 𝜖 (Section 6.1).

   Collapse this answer

4. 04What experiments did the paper conduct?

   Systematically evaluate four attack settings, the calibration gain, comparison with two baselines, and DP defense on three datasets, five GAN-type models and VAE.

   Experimental Setup

   • Victim models: five GAN-type models—PGGAN, WGANGP, DCGAN, MEDGAN, and VAEGAN—with VAE additionally included in the baseline comparison; the defense experiment uses PGGAN trained with DP-SGD (PGGAN w/ DP).
   • Datasets: CelebA (faces, at most 20k images, cropped and resized to 64×64), MIMIC-III (electronic health records, 41,307 records after preprocessing, each a 1071-dimensional binary vector), and Instagram New-York (location check-ins, 34,336 records, each 4048-dimensional).
   • Baselines: LOGAN [25] (full black-box and accessible discriminator) and MC [29] (full black-box, used only on CelebA, not applicable to non-image data).
   • Metrics: attack performance uses AUCROC (obtained by varying the threshold 𝜖); generation quality uses FID (Table 3: on CelebA, PGGAN 14.86, WGANGP 24.26, DCGAN 35.40, VAEGAN 53.08, PGGAN w/ DP 15.63).
   • Analysis dimensions: training set size (varying from 64 to 20k/8192/10k) and training set selection method (random and identity-based, CelebA only); under small training sets DCGAN and VAEGAN train unstably and are excluded from the size analysis.
   • Reference models for calibration: the CelebA black-box setting uses a PGGAN trained on LFW; on MIMIC-III, WGANGP and MEDGAN serve as each other's reference models (Section 6.6).

   Main Results

   AUCROC of each attack on CelebA (training set 20k) (according to Table 12):

   Swipe horizontally to read the table

   Attack setting	PGGAN	WGANGP	DCGAN	VAEGAN	VAE
   full black-box (LOGAN)	0.56	0.57	0.52	0.50	0.52
   full black-box (MC)	0.52	0.52	0.51	0.50	0.51
   full black-box (this paper, calibrated)	0.54	0.54	0.52	0.51	0.54
   partial black-box (this paper, calibrated)	0.58	0.63	0.56	0.59	0.73
   white-box (this paper, calibrated)	0.68	0.66	0.55	0.76	0.94
   accessible discriminator (LOGAN/MC)	0.91	0.83	0.83	0.61	0.90

   • The authors state that this paper's white-box and partial black-box attacks consistently outperform the full black-box attacks, closing the performance gap between full black-box and discriminator-accessible attacks.
   • The authors state that the calibrated white-box attack exceeds LOGAN (accessible discriminator) on VAEGAN and exceeds MC (accessible full model) on VAE, i.e., achieving higher AUCROC under settings with less knowledge.
   • The authors state that this paper's full black-box attack consistently outperforms MC, outperforms LOGAN on non-image datasets, and is comparable to LOGAN on CelebA but simpler to implement and requires no learning.

   Effect of Training Set Size and Selection Method

   • Size: the smaller the training set, the stronger the attack; on CelebA, when the training set is no more than 512, the full black-box attack achieves AUCROC above 0.95 for both PGGAN and WGANGP (Figure 5(a)); the white-box attack remains effective on CelebA with 20k training samples, and drops to 8192 and 2048 on MIMIC-III and Instagram, respectively (Section 6.5.1).
   • Selection method: under identity-based selection all models are more vulnerable; for example, under the white-box attack on CelebA 20k, PGGAN rises from 0.54 with random to 0.59 with identity, and VAEGAN rises from 0.61 to 0.63 (Table 7).
   • Model differences: under full black-box, DCGAN and VAEGAN have AUCROC only slightly above 0.5; the authors suggest this may be attributable to their poorer generation quality (Table 3).

   Gain from Attack Calibration

   • On CelebA 20k, calibration improves AUCROC under all settings and all architectures (Table 10): under white-box, PGGAN rises from 0.59 to 0.68, and VAEGAN rises from 0.63 to 0.76; the authors state the VAEGAN improvement is about 0.2 (the main text in Section 6.6 is inconsistent with the 0.13 in Table 10; here the main text's statement is given alongside the table number).
   • On non-image datasets, calibration likewise improves performance under all training set sizes (Table 11); for example, on MIMIC-III, MEDGAN's full black-box rises from 0.78 to 0.91 at size 64.

   DP Defense

   • Applying DP-SGD to PGGAN on CelebA (norm threshold 1.0, noise scale 10^-4): after calibration, the white-box attack's AUCROC drops from 0.68 to 0.59, and full black-box drops from 0.54 to 0.53 (Table 15); a consistent decrease holds across all training set sizes (Table 16).
   • The authors report that DP makes training 10 times slower and raises FID from 14.86 to 15.63 (Table 3), and that to maintain usable generation quality the noise is limited, so the attack still outperforms random guessing under all settings (AUCROC = 0.5); the authors state that the 𝜖 value is then very high (>10^10, 𝛿=10^-5).

   Other Ablations and Analyses

   • Number of generated samples k (full black-box, PGGAN, CelebA): as k increases from 64 to 100k, this paper's calibrated attack's AUCROC rises from 0.51 to 0.55 (Table 14).
   • Distance metric ablation (white-box, CelebA): the full three-term metric is no weaker than single terms on most models; for example, on VAEGAN, L2+LPIPS+Lreg is 0.63 and L2 alone is 0.62 (Table 8).
   • Reconstruction feasibility sanity check: reconstructing generated samples of the four GANs yields success rates all above 99% (Table 5, 99.25%–99.89%).
   • Optimizer comparison: the authors state that L-BFGS converges better than Adam and RMSProp and has no additional hyperparameters (Figure 13).

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not specifically discuss limitations; the experiments cover three datasets, five GAN-type models and VAE, and the defense evaluation covers only DP-SGD.

   Limitations and Future Directions Noted by the Authors

   • The paper does not specifically discuss limitations. The Conclusion (Section 7) only expresses the hope that the taxonomy can benchmark future research, and does not list specific limitations or future work.

   Scope of Experimental Coverage

   • The models tested are five GAN-type models—PGGAN, WGANGP, DCGAN, MEDGAN, and VAEGAN—with VAE added in the baseline comparison; the attack under the accessible discriminator setting directly follows the LOGAN/MC baseline methods, and this paper does not propose a new attack under that setting (Section 4.1 states less effort was invested in it).
   • The datasets are three: CelebA, MIMIC-III, and Instagram New-York; the comparison between identity-based and random selection methods is conducted only on CelebA (Table 7).
   • The defense evaluation includes only DP-SGD, and only on PGGAN on CelebA; the authors state that other cases were skipped because DP always degrades generation quality to an unacceptable level (Section 6.8).
   • The training set size analysis excludes DCGAN and VAEGAN because the two train unstably under small training sets (Section 6.2.1).
   • The paper does not report the number of experimental repetitions, confidence intervals, or statistical significance tests; k for the full black-box attack is fixed at 20k (Appendix B.1), and the maximum numbers of iterations for white-box and partial black-box are 1000 and 10, respectively.

   Collapse this answer

6. 06Summarize the main content of the paper

   Membership inference against generative models: a four-setting threat model taxonomy, a general reconstruction-error-based attack and calibration technique, systematically evaluated on three datasets.

   A study of membership inference attacks (MIA) against deep generative models, in which the authors claim to establish the first attack taxonomy and propose the first general attack model instantiable across settings and model types.

   • Problem: generative models do not output confidence and suffer from mode dropping, making MIA harder; existing work (LOGAN, MC) has incomplete settings and lacks a general attack and systematic analysis.
   • Method: assume membership probability is proportional to the probability that a sample can be generated by the victim generator, approximated by reconstruction error; full black-box uses nearest neighbor, partial black-box uses Powell black-box optimization, white-box uses L-BFGS for reconstruction; then per-sample calibration is done using the error of an independent reference GAN, which the authors prove is near-Bayes-optimal (Theorem 5.1).
   • Main results (CelebA 20k, Table 12): after calibration, the white-box attack's AUCROC is 0.68 on PGGAN, 0.76 on VAEGAN, and 0.94 on VAE; the accessible discriminator baseline is 0.91 on PGGAN; the authors state that the white-box attack exceeds the more knowledgeable discriminator-accessible baseline on VAEGAN and VAE.
   • Calibration gain: calibration improves AUCROC under all settings and all architectures (Table 10, 11); the authors state an improvement of about 0.2 on VAEGAN.
   • Patterns: the smaller the training set and when the training set is selected by identity, the stronger the attack; on CelebA when the training set is no more than 512, the full black-box attack's AUCROC exceeds 0.95.
   • Defense: DP-SGD reduces the calibrated white-box attack from 0.68 to 0.59 (Table 15), but training is 10 times slower, FID worsens, and the attack still outperforms random guessing; the authors consider DP effective but at the cost of computational burden and degraded generation quality.

   Collapse this answer

Related papers