On the Privacy Properties of GAN-generated Samples
On the Privacy Properties of GAN-generated Samples
复制标题
DOI：
10.48550/arxiv.2206.01349
复制
发表时间：
2022-06
期刊：
影响因子：
--
通讯作者：
Zinan Lin;Vyas Sekar;G. Fanti
中科院分区：
文献类型：
--
作者：
Zinan Lin;Vyas Sekar;G. Fanti
生成对抗网络（GAN）的隐私影响是一个非常有趣的话题，导致最近出现了几种用于训练具有隐私保证的GAN的算法。通过与GAN的泛化特性建立联系，我们证明了在某些假设下，GAN生成的样本本质上满足某些（弱）隐私保证。首先，我们证明了如果GAN在m个样本上训练并用于生成n个样本，则生成的样本对于（delta，delta）对是（delta，delta）-差分私有的，其中delta的尺度为O（n/m）。我们证明了在某些特殊条件下，这个上界是紧的。接下来，我们研究了GAN生成的样本对成员推理攻击的鲁棒性。我们将成员推断建模为假设检验，其中对手必须确定给定样本是从训练数据集还是从底层数据分布中提取的。我们表明，这种对手可以实现ROC曲线下的面积，其规模不优于O（m^{-1/4}）。
The privacy implications of generative adversarial networks (GANs) are a topic of great interest, leading to several recent algorithms for training GANs with privacy guarantees. By drawing connections to the generalization properties of GANs, we prove that under some assumptions, GAN-generated samples inherently satisfy some (weak) privacy guarantees. First, we show that if a GAN is trained on m samples and used to generate n samples, the generated samples are (epsilon, delta)-differentially-private for (epsilon, delta) pairs where delta scales as O(n/m). We show that under some special conditions, this upper bound is tight. Next, we study the robustness of GAN-generated samples to membership inference attacks. We model membership inference as a hypothesis test in which the adversary must determine whether a given sample was drawn from the training dataset or from the underlying data distribution. We show that this adversary can achieve an area under the ROC curve that scales no better than O(m^{-1/4}).