GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
Open accessAbstract
Deep learning has achieved overwhelming success, spanning from discriminative models to generative models. In particular, deep generative models have facilitated a new level of performance in a myriad of areas, ranging from media manipulation to sanitized dataset generation. Despite the great success, the potential risks of privacy breach caused by generative models have not been analyzed systematically. In this paper, we focus on membership inference attack against deep generative models that reveals information about the training data used for victim models. Specifically, we present the first taxonomy of membership inference attacks, encompassing not only existing attacks but also our novel ones. In addition, we propose the first generic attack model that can be instantiated in a large range of settings and is applicable to various kinds of deep generative models. Moreover, we provide a theoretically grounded attack calibration technique, which consistently boosts the attack performance in all cases, across different attack settings, data modalities, and training configurations. We complement the systematic analysis of attack performance by a comprehensive experimental study, that investigates the effectiveness of various attacks w.r.t. model type and training configurations, over three diverse application scenarios (i.e., images, medical data, and location data).
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Membership inference is the most well-established privacy attack and arguably constitutes a bigger privacy threat than class-level attacks, such as the attacks in [7, 59] and model inversion [18, 19].
“We emphasize that membership inference is the most wellestablished privacy attack and arguably constitutes a bigger privacy threat [13,28,30,37,46,48,60,66,67,75] than classlevel attacks, such as the attacks in [7, 59] and model inversion [18, 19].”
From When Machine Unlearning Jeopardizes Privacy (2021) · cites this paper as [13]
The Introduction (p. 1) identifies membership inference as a privacy attack that can expose whether a person's record was used in training, and the Abstract (p. 1) describes a taxonomy encompassing existing attacks. These passages support treating it as an established privacy concern, but the paper does not say it is the most well-established attack or compare its threat with class-level attacks or model inversion. (LLM, conf=0.82)
Experimental — accuracy not yet measuredDeep-faked patient face images could violate patient privacy and lead to the leakage or exploitation of protected health information.
“Deep-faked patient face images could violate patient privacy and lead to the leakage or exploitation of PHI [75].”
From Generative AI in medical practice: in-depth exploration of privacy and security challenges (2024) · cites this paper as [75]
The Introduction (p. 1) says membership inference against GANs used with health records or medical images may reveal a patient’s disease history. The Setup (p. 7) treats face images and patient records as separate datasets. The paper supports a risk of patient-data leakage, but does not address deep-faked patient faces specifically or exploitation of protected health information. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946 · see citing works
Very Deep Convolutional Networks for Large-Scale Image Recognition
Simonyan, K., & Zisserman, A. (2014) · arXiv · doi:10.48550/arxiv.1409.1556 · Cited by 74,248 · see citing works
Going deeper with convolutions
Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., & Rabinovich, A. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298594 · Cited by 48,562 · see citing works
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
Unpaired image-to-image translation using cycle-consistent adversarial networks
Zhu, J.-Y., Park, T., Isola, P., & Efros, A. A. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.244 · Cited by 23,602 · see citing works
Image-to-Image Translation with Conditional Adversarial Networks
Isola, P., Zhu, J.-Y., Zhou, T., & Efros, A. A. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.632 · Cited by 22,930 · see citing works
Labaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,100 · see citing works
Auto-Encoding Variational Bayes
Kingma, D. P., & Welling, M. (2013) · arXiv · doi:10.48550/arxiv.1312.6114 · Cited by 20,067 · see citing works
Seel, N. M. (2012) · Springer eBooks · doi:10.1007/978-1-4419-1428-6_5195 · Cited by 19,525 · see citing works
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 19,268 · see citing works
The Unreasonable Effectiveness of Deep Features as a Perceptual Metric
Zhang, R., Isola, P., Efros, A. A., Shechtman, E., & Wang, O. (2018) · 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2018.00068 · Cited by 14,623 · see citing works
Unsupervised representation learning with deep convolutional generative adversarial networks
Radford, A., Metz, L., & Chintala, S. (2015) · arXiv · doi:10.48550/arxiv.1511.06434 · Cited by 12,235 · see citing works
A Style-Based Generator Architecture for Generative Adversarial Networks
Karras, T., Laine, S., & Aila, T. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00453 · Cited by 11,714 · see citing works
Speech recognition with deep recurrent neural networks
Graves, A., Mohamed, A.-R., & Hinton, G. (2013) · 2013 IEEE International Conference on Acoustics, Speech and Signal Processing · doi:10.1109/icassp.2013.6638947 · Cited by 8,893 · see citing works
On the limited memory BFGS method for large scale optimization
Liu, D. C., & Nocedal, J. (1989) · Mathematical Programming · doi:10.1007/bf01589116 · Cited by 8,684 · see citing works
GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., & Hochreiter, S. (2017) · arXiv · doi:10.48550/arxiv.1706.08500 · Cited by 8,365 · see citing works
MIMIC-III, a freely accessible critical care database
Johnson, A. E. W., Pollard, T. J., Shen, L., Lehman, L.-W. H., Feng, M., Ghassemi, M., Moody, B., Szolovits, P., Anthony Celi, L., & Mark, R. G. (2016) · Scientific Data · doi:10.1038/sdata.2016.35 · Cited by 8,141 · see citing works
Deep Learning Face Attributes in the Wild
Liu, Z., Luo, P., Wang, X., & Tang, X. (2015) · 2015 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2015.425 · Cited by 7,747 · see citing works
Calibrating Noise to Sensitivity in Private Data Analysis
Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006) · Lecture Notes in Computer Science · doi:10.1007/11681878_14 · Cited by 7,272 · see citing works
Improved training of Wasserstein GANs
Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., & Courville, A. (2017) · arXiv · doi:10.48550/arxiv.1704.00028 · Cited by 6,800 · see citing works
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
(2017) · International Conference on Machine Learning · Cited by 6,382 · see citing works
Analyzing and Improving the Image Quality of StyleGAN
Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., & Aila, T. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00813 · Cited by 6,332 · see citing works
Show and tell: A neural image caption generator
Vinyals, O., Toshev, A., Bengio, S., & Erhan, D. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298935 · Cited by 6,318 · see citing works
International Conference on Learning Representations (ICLR 2013)
松尾, 豊. (2013) · 人工知能学会誌 = Journal of Japanese Society for Artificial Intelligence · Cited by 6,286 · see citing works
Image Style Transfer Using Convolutional Neural Networks
Gatys, L. A., Ecker, A. S., & Bethge, M. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.265 · Cited by 6,025 · see citing works
Context Encoders: Feature Learning by Inpainting
Pathak, D., Krahenbuhl, P., Donahue, J., Darrell, T., & Efros, A. A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.278 · Cited by 5,691 · see citing works
WaveNet: a generative model for raw audio
Oord, A. V. D., Dieleman, S., Zen, H., Simonyan, K., Vinyals, O., Graves, A., Kalchbrenner, N., Senior, A., & Kavukcuoglu, K. (2016) · arXiv · doi:10.48550/arxiv.1609.03499 · Cited by 4,911 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Powell, M. J. D. (1964) · The Computer Journal · doi:10.1093/comjnl/7.2.155 · Cited by 4,632 · cited 2× · see citing works
“As only the evaluation of function (forward-pass through the generator) is allowed by the access of {𝑧,G𝑣 (𝑧)} pair, we propose to approximate the optimum via the Powell’s Conjugate Direction Method [53].”
MethodLabeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445 · see citing works
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856 · see citing works
Large Scale GAN Training for High Fidelity Natural Image Synthesis
Brock, A., Donahue, J., & Simonyan, K. (2018) · arXiv · doi:10.48550/arxiv.1809.11096 · Cited by 3,717 · see citing works
Stochastic Backpropagation and Approximate Inference in Deep Generative ModelsPreprint
Rezende, D. J., Mohamed, S., & Wierstra, D. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1401.4082 · Cited by 3,679 · see citing works
Differential Privacy: A Survey of Results
Dwork, C. (2008) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-79228-4_1 · Cited by 3,542 · see citing works
Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1406.1078 · Cited by 3,317 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural NetworksPreprint
Salimans, T., & Kingma, D. P. (2016) · Neural Information Processing Systems · doi:10.48550/arxiv.1602.07868 · Cited by 2,284 · see citing works
Generative adversarial network in medical imaging: A review
Xin, Y., Walia, E., & Babyn, P. (2019) · Medical Image Analysis · doi:10.1016/j.media.2019.101552 · Cited by 1,883 · see citing works
Deep Neural Networks for Acoustic Modeling in Speech Recognition
Hinton, G. E., Deng, L., Yu, D., Dahl, G. E., Mohamed, A., Jaitly, N., Senior, A., Vanhoucke, V., Nguyen, P., Sainath, T. N., et al. (2012) · Cited by 1,839 · see citing works
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760 · see citing works
Face2Face: Real-Time Face Capture and Reenactment of RGB Videos
Thies, J., Zollhofer, M., Stamminger, M., Theobalt, C., & Niessner, M. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.262 · Cited by 1,747 · see citing works
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734 · see citing works
International Conference on Learning Representations (ICLR)
Abbas, M., Kivinen, J., & Raiko, T. (2016) · Cited by 1,632 · see citing works
Precomputed Real-Time Texture Synthesis with Markovian Generative Adversarial Networks
Li, C., & Wand, M. (2016) · European Conference on Computer Vision · doi:10.1007/978-3-319-46487-9_43 · Cited by 1,535 · see citing works
NICE: Non-linear Independent Components Estimation
Dinh, L., Krueger, D., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1410.8516 · Cited by 1,493 · see citing works
Autoencoding beyond pixels using a learned similarity metric
Larsen, A., Sønderby, S. K., Larochelle, H., & Winther, O. (2016) · Research at the University of Copenhagen (University of Copenhagen) · Cited by 1,317 · see citing works
Toward Multimodal Image-to-Image TranslationPreprint
Zhu, J.-Y., Zhang, R., Pathak, D., Darrell, T., Efros, A. A., Wang, O., & Shechtman, E. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.11586 · Cited by 1,159 · see citing works
Gold, B., Morgan, N. H., & Ellis, D. P. W. (2011) · doi:10.1002/9781118142882.ch8 · Cited by 1,120 · see citing works
In defense of Nearest-Neighbor based image classification
Boiman, O., Shechtman, E., & Irani, M. (2008) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2008.4587598 · Cited by 1,079 · see citing works
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001 · see citing works
(2011) · PubMed · Cited by 990 · see citing works
Synthetic data augmentation using GAN for improved liver lesion classification
Frid-Adar, M., Klang, E., Amitai, M. M., Goldberger, J., & Greenspan, H. K. (2018) · IEEE International Symposium on Biomedical Imaging (ISBI) · doi:10.1109/isbi.2018.8363576 · Cited by 919 · see citing works
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852 · see citing works
Self-citationAttGAN: Facial attribute editing by only changing what you want
He, Z., Zuo, W., Kan, M., Shan, S., & Chen, X. (2019) · IEEE Transactions on Image Processing · doi:10.1109/tip.2019.2916751 · Cited by 833 · see citing works
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796 · see citing works
Attribute2Image: Conditional Image Generation from Visual Attributes
Yan, X., Yang, J., Sohn, K., & Lee, H. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-46493-0_47 · Cited by 688 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., & Song, D. (2018) · arXiv · doi:10.48550/arxiv.1802.08232 · Cited by 629 · see citing works
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2014) · arXiv · doi:10.48550/arxiv.1409.0575 · Cited by 567 · see citing works
Stochastic gradient descent with differentially private updates
Song, S., Chaudhuri, K., & Sarwate, A. D. (2013) · IEEE Global Conference on Signal and Information Processing · doi:10.1109/globalsip.2013.6736861 · Cited by 524 · see citing works
Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., & Felici, G. (2015) · International Journal of Security and Networks · doi:10.1504/ijsn.2015.071829 · Cited by 482 · see citing works
Generalization and Equilibrium in Generative Adversarial Nets (GANs)Preprint
Arora, S., Ge, R., Liang, Y., Ma, T., & Zhang, Y. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.00573 · Cited by 468 · see citing works
Self-citationGenerating Multi-label Discrete Patient Records using Generative Adversarial NetworksPreprint
Choi, E., Biswal, S., Malin, B., Duke, J. D., Stewart, W. F., & Sun, J. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.06490 · Cited by 422 · see citing works
SampleRNN: An Unconditional End-to-End Neural Audio Generation ModelPreprint
Mehri, S., Kumar, K., Gulrajani, I., Kumar, R., Jain, S., Sotelo, J., Courville, A. C., & Bengio, Y. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1612.07837 · Cited by 414 · see citing works
Privacy-Preserving Generative Deep Neural Networks Support Clinical Data Sharing
Beaulieu‐Jones, B. K., Wu, Z. S., Williams, C., Lee, R., Bhavnani, S. P., Byrd, J. B., & Greene, C. S. (2019) · Circulation Cardiovascular Quality and Outcomes · doi:10.1161/circoutcomes.118.005122 · Cited by 407 · see citing works
Jia, J., Salem, A., Michael Backes, A., Zhang, Y., & Gong, N. Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363201 · Cited by 374 · see citing works
Self-citationReal-time expression transfer for facial reenactment
Thies, J., Zollhöfer, M., Nießner, M., Valgaerts, L., Stamminger, M., & Theobalt, C. (2015) · ACM Transactions on Graphics · doi:10.1145/2816795.2818056 · Cited by 369 · see citing works
PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees
Jordon, J., Yoon, J., & van der Schaar, M. (2018) · International Conference on Learning Representations · Cited by 360 · see citing works
Privacy-Preserving Datamining on Vertically Partitioned Databases
Dwork, C., & Nissim, K. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-28628-8_32 · Cited by 359 · see citing works
Differentially Private Data Publishing and Analysis: A Survey
Zhu, T., Li, G., Zhou, W., & Yu, P. S. (2017) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2017.2697856 · Cited by 330 · see citing works
Differentially Private Generative Adversarial NetworkPreprint
Xie, L., Lin, K., Wang, S., Wang, F., & Zhou, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.06739 · Cited by 322 · see citing works
Image Processing Using Multi-Code GAN Prior
Gu, J., Shen, Y., & Zhou, B. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00308 · Cited by 319 · see citing works
Deep Models Under the GAN: Information Leakage from Collaborative Deep LearningPreprint
Hitaj, B., Ateniese, G., & Pérez‐Cruz, F. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.07464 · Cited by 232 · see citing works
Non-stationary texture synthesis by adversarial expansion
Zhou, Y., Zhu, Z., Bai, X., Lischinski, D., Cohen‐Or, D., & Huang, H. F. (2018) · ACM Transactions on Graphics · doi:10.1145/3197517.3201285 · Cited by 181 · see citing works
White-box vs Black-box: Bayes Optimal Strategies for Membership InferencePreprint
Sablayrolles, A., Douze, M., Ollivier, Y., Schmid, C., & Jeǵou, H. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.11229 · Cited by 176 · see citing works
Privacy-Preserving Deep Learning: Revisited and Enhanced
Phong, L. T., Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2017) · Communications in computer and information science · doi:10.1007/978-981-10-5421-1_9 · Cited by 170 · see citing works
On the "steerability" of generative adversarial networksPreprint
Jahanian, A., Chai, L., & Isola, P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.07171 · Cited by 169 · see citing works
Understanding Membership Inferences on Well-Generalized Learning Models
Long, Y., Bindschaedler, V., Wang, L., Bu, D., Wang, X., Tang, H., Gunter, C. A., & Chen, K. (2018) · arXiv · doi:10.48550/arxiv.1802.04889 · Cited by 166 · see citing works
Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models
Hilprecht, B., Härterich, M., & Bernau, D. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0067 · Cited by 158 · see citing works
Robust Traceability from Trace Amounts
Dwork, C., Smith, A., Steinke, T., Ullman, J., & Vadhan, S. (2015) · Annual Symposium on Foundations of Computer Science · doi:10.1109/focs.2015.46 · Cited by 142 · see citing works
Differentially Private Mixture of Generative Neural Networks
Ács, G., Melis, L., Castelluccia, C., & Cristofaro, E. D. (2017) · Proceedings · doi:10.1109/icdm.2017.81 · Cited by 137 · see citing works
Membership Privacy in MicroRNA-based Studies
Michael Backes, A., Berrang, P., Humbert, M., & Manoharan, P. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978355 · Cited by 133 · see citing works
Michael Backes, A., Humbert, M., Pang, J., & Zhang, Y. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3133972 · Cited by 125 · see citing works
Self-citationInference Attacks Against Collaborative Learning.Preprint
Melis, L., Song, C., Cristofaro, E. D., & Shmatikov, V. (2018) · arXiv (Cornell University) · Cited by 93 · see citing works
Differentially Private Releasing via Deep Generative ModelPreprint
Zhang, X.-Y., Ji, S.-L., & Wang, T. (2018) · arXiv.org · doi:10.48550/arxiv.1801.01594 · Cited by 75 · see citing works
LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks.Preprint
Hayes, J., Melis, L., Danezis, G., & Cristofaro, E. D. (2017) · arXiv (Cornell University) · Cited by 59 · see citing works
What Does The Crowd Say About You? Evaluating Aggregation-based Location Privacy
Pyrgelis, A., Troncoso, C., & Cristofaro, E. D. (2017) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2017-0043 · Cited by 56 · see citing works
GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators
Chen, D., Orekondy, T., & Fritz, M. (2020) · Figshare · doi:10.60882/cispa.24613350 · Cited by 56 · see citing works
Self-citationDifferentially Private Releasing via Deep Generative ModelPreprint
Zhang, X., Ji, S., & Wang, T. (2018) · arXiv (Cornell University) · Cited by 53 · see citing works
Texture Mixer: A Network for Controllable Synthesis and Interpolation of Texture
Yu, N., Barnes, C., Shechtman, E., Amirghodsi, S., & Lukáč, M. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.01244 · Cited by 51 · see citing works
Self-citationInclusive GAN: Improving Data and Minority Coverage in Generative Models
Yu, N., Li, K., Zhou, P., Malik, J., Davis, L., & Fritz, M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58542-6_23 · Cited by 45 · see citing works
Self-citationPrivacy-Protective-GAN for Face De-identificationPreprint
Wu, Y., Yang, F., & Ling, H. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.08906 · Cited by 44 · see citing works
On the limited memory BFGS method for large scale optimization
LiuDong, C., & NocedalJorge (1989) · Mathematical Programming · doi:10.5555/3112655.3112866 · Cited by 44 · see citing works
MBeacon: Privacy-Preserving Beacons for DNA Methylation Data
Hagestedt, I., Zhang, Y., Humbert, M., Berrang, P., Tang, H., Wang, X., & Michael Backes, A. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23064 · Cited by 43 · see citing works
Self-citationAttGAN: Facial Attribute Editing by Only Changing What You WantPreprint
He, Z., Zuo, W., Kan, M., et al. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.10678 · Cited by 41 · see citing works
Label-Leaks: Membership Inference Attack with Label.Preprint
Li, Z., & Yan, S. (2020) · arXiv (Cornell University) · Cited by 35 · see citing works
Microsoft Azure Machine Learning
Mund, S. (2015) · CERN Document Server (European Organization for Nuclear Research) · Cited by 30 · see citing works
GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private GeneratorsPreprint
Chen, D., Orekondy, T., & Fritz, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.08265 · Cited by 30 · see citing works
Self-citationAccurate and Diverse Sampling of Sequences Based on a ``Best of Many'' Sample ObjectivePreprint
Bhattacharyya, A., Schiele, B., & Fritz, M. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.07772 · Cited by 26 · see citing works
Self-citationLearning from Data with Heterogeneous Noise using SGD.
Song, S., Chaudhuri, K., & Sarwate, A. D. (2015) · PubMed · Cited by 23 · see citing works
walk2friends: Inferring Social Links from Mobility ProfilesPreprint
Michael Backes, A., Humbert, M., Pang, J., & Zhang, Y. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1708.08221 · Cited by 16 · see citing works
Self-citationMembership Leakage in Label-Only ExposuresPreprint
Li, Z., & Zhang, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.15528 · Cited by 15 · see citing works
Self-citationImage Processing Using Multi-Code GAN PriorPreprint
Gu, J., Shen, Y., & Zhou, B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.07116 · Cited by 11 · see citing works
"Best-of-Many-Samples" Distribution MatchingPreprint
Bhattacharyya, A., Fritz, M., & Schiele, B. (2019) · arXiv.org · doi:10.48550/arxiv.1909.12598 · Cited by 4 · see citing works
Self-citation
Flagged first, then by citations
Research works printed but not linked: 5
- [9][9] Oren Boiman, Eli Shechtman, and Michal Irani. 2008. In Defense of NearestNeighbor based Image Classification. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . IEEE. -
- [33][33] Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019. MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples. In ACM SIGSAC Conference on Computer and Communications Security (CCS) . ACM, 259-274. -
- [40][40] Diederik P. Kingma and Prafulla Dhariwal. 2018. Glow: Generative Flow with Invertible 1x1 Convolutions. In Annual Conference on Neural Information Processing Systems (NeurIPS) . NeurIPS, 10236-10245. -
- [59][59] Tim Salimans, Ian J. Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. 2016. Improved Techniques for Training GANs. In Annual Conference on Neural Information Processing Systems (NIPS) . NIPS, 2226-2234. -
- [63][63] Tijmen Tieleman and Geoffrey Hinton. 2012. Lecture 6.5-rmsprop: Divide the Gradient by a Running average of its Recent Magnitude. COURSERA: Neural Networks for Machine Learning 4, 2 (2012), 26-31. -
Cited by
Sorted by citations
Synthetic data in machine learning for medicine and healthcare
Chen, R. J., Lu, M. Y., Chen, T. Y., Williamson, D. F. K., & Mahmood, F. (2021) · Nature Biomedical Engineering · doi:10.1038/s41551-021-00751-8 · Cited by 728 · see citing works
Artificial intelligence in histopathology: enhancing cancer research and clinical oncology
Shmatko, A., Ghaffari Laleh, N., Gerstung, M., & Kather, J. N. (2022) · Nature Cancer · doi:10.1038/s43018-022-00436-4 · Cited by 446 · see citing works
Generative AI in medical practice: in-depth exploration of privacy and security challenges
Chen, Y., & Esmaeilzadeh, P. (2024) · Journal of Medical Internet Research · doi:10.2196/53008 · Cited by 353 · see citing works
“Deep-faked patient face images could violate patient privacy and lead to the leakage or exploitation of PHI [75].”
When Machine Unlearning Jeopardizes Privacy
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484756 · Cited by 195 · see citing works
“Since then, membership inference has been extensively investigated in various ML models and tasks, such as federated learning [46], white-box classification [48], generative adversarial networks [13, 28], natural language processing [67], and computer vision segmentation [30].”
BackgroundSelf-citationLocal and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Survey: Leakage and Privacy at Inference Time
Jegorova, M., Kaul, C., Mayor, C., O'Neil, A. Q., Weir, A., Murray-Smith, R., & Tsaftaris, S. A. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3229593 · Cited by 77 · see citing works
Membership Inference Attacks against GANs by Leveraging Over-representation Regions
Hu, H., & Pang, J. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3485338 · Cited by 16 · see citing works
- Authors
- Chen, D., Yu, N., Zhang, Y., & Fritz, M.
- Affiliations
- Helmholtz Center for Information Security (DE)
- Max Planck Institute for Informatics (DE)
- Venue
- Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2020-10-30
- Pages
- 343-362
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W3071470454
- Cited by
- 311
- References
- 108
- Citations by year
- 2026: 30 · 2025: 50 · 2024: 60 · 2023: 63 · 2022: 48 · 2021: 44 · 2020: 14 · 2019: 2
- FWCI
- 16.12
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Figshare (submittedVersion, cc-by)
- arXiv (Cornell University)
- CISPA Helmholtz Center
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, generative models, privacy leakage, training data privacy, attack taxonomy, deep generative models, medical data privacy, location privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
