Privacy properties of GAN-generated samples

Starting from the generalization properties of GANs, the paper proves that under certain assumptions GAN-generated samples themselves satisfy a weak differential privacy guarantee. The authors point out that if a GAN is trained on m samples and generates n samples, the generated samples satisfy (epsilon, delta)-differential privacy, where delta grows as O(n/m); under certain special conditions this upper bound is tight. The paper also models membership inference as a hypothesis test, requiring distinguishing whether a sample comes from the training set or the underlying data distribution, and gives an upper bound of no more than O(m^{-1/4}) on the area under the ROC curve for this attacker.