Membership Inference Attacks against GANs by Leveraging Over-representation Regions
Open accessAbstract
Generative adversarial networks (GANs) have made unprecedented performance in image synthesis and play a key role in various downstream applications of computer vision. However, GAN models trained on sensitive data also pose a distinct threat to privacy. In this poster, we present a novel over-representation based membership inference attack. Unlike prior attacks against GANs which focus on the overall metrics, such as the attack accuracy, our attack aims to make inference from the high-precision perspective, which allows the adversary to concentrate on inferring a sample as a member confidently. Initial experimental results demonstrate that the adversary can achieve a high precision attack even if the overall attack accuracy is about 50% for a well-trained GAN model. Our work will raise awareness of the importance of precision when GAN owners evaluate the privacy risks of their models.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The text we found for this paper looks like another document, so the self-check wasn’t run.
Cites
A Style-Based Generator Architecture for Generative Adversarial Networks
Karras, T., Laine, S., & Aila, T. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00453 · Cited by 11,714 · see citing works
GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., & Hochreiter, S. (2017) · arXiv · doi:10.48550/arxiv.1706.08500 · Cited by 8,365 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001 · see citing works
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852 · see citing works
Extracting Training Data from Large Language Models
Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al. (2020) · arXiv · doi:10.48550/arxiv.2012.07805 · Cited by 727 · see citing works
The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., & Song, D. (2018) · arXiv · doi:10.48550/arxiv.1802.08232 · Cited by 629 · see citing works
LOGAN: Membership Inference Attacks Against Generative Models
Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0008 · Cited by 433 · see citing works
GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
Chen, D., Yu, N., Zhang, Y., & Fritz, M. (2020) · Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3372297.3417238 · Cited by 311 · see citing works
Systematic Evaluation of Privacy Risks of Machine Learning ModelsPreprint
Song, L., & Mittal, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.10595 · Cited by 185 · see citing works
Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
Leino, K., & Fredrikson, M. (2019) · arXiv · doi:10.48550/arxiv.1906.11798 · Cited by 145 · see citing works
A Pragmatic Approach to Membership Inferences on Machine Learning Models
Long, Y., Wang, L., Bu, D., Bindschaedler, V., Wang, X., Tang, H., Gunter, C. A., & Chen, K. (2020) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp48549.2020.00040 · Cited by 80 · see citing works
A Non-Parametric Test to Detect Data-Copying in Generative ModelsPreprint
Meehan, C., Chaudhuri, K., & Dasgupta, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.05675 · Cited by 24 · see citing works
Flagged first, then by citations
1 of the 14 references couldn’t be matched to a known paper.
Research works printed but not linked: 3
- Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. In Proceedings of Annual Conference on Neural Information Processing Systems (NeurIPS). Curran Associates, Inc., 2672-2680.
- Hailong Hu and Jun Pang. 2021. Model Extraction and Defenses on Generative Adversarial Networks. ArXiv preprint arXiv:2101.02069 (2021). · arXiv
- Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. 2018. Progressive Growing of GANs for Quality, Stability, and Variation. In Proceedings of International Conference on Learning Representations (ICLR).
Cited by
Sorted by citations
Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models
Somepalli, G., Singla, V., Goldblum, M., Geiping, J., & Goldstein, T. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00586 · Cited by 206 · see citing works
Xu, H., Zhu, T., Zhang, L., Zhou, W., & Yu, P. S. (2024) · ACM Computing Surveys · doi:10.1145/3603620 · Cited by 164 · see citing works
“In general, the majority of model attack scenarios, such as membership inference attacks, arise from model overitting and rely on observing shifts in the output based on known input shifts [62].”
BackgroundSynthetic data in biomedicine via generative artificial intelligence
van Breugel, B., Liu, T., Oglić, D., & van der Schaar, M. (2024) · Nature Reviews Bioengineering · doi:10.1038/s44222-024-00245-7 · Cited by 97 · see citing works
PPA: Preference Profiling Attack Against Federated Learning
Zhou, C., Gao, Y., Fu, A., Chen, K., Dai, Z., Zhang, Z., Xue, M., & Zhang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23171 · Cited by 38 · see citing works
A survey on membership inference attacks and defenses in machine learning
Niu, J., Liu, P., Zhu, X., Shen, K., Wang, Y., Chi, H., Shen, Y., Jiang, X., Ma, J., & Zhang, Y. (2024) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2024.02.001 · Cited by 40 · see citing works
A consensus privacy metrics framework for synthetic data
Pilgram, L., Dankar, F. K., Drechsler, J., Elliot, M. J., Domingo‐Ferrer, J., Francis, P., Kantarcıoğlu, M., Kong, L., Malin, B., Muralidhar, K., et al. (2025) · Patterns · doi:10.1016/j.patter.2025.101320 · Cited by 24 · see citing works
Loss and Likelihood Based Membership Inference of Diffusion Models
Hu, H., & Pang, J. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-49187-0_7 · Cited by 17 · see citing works
Self-citationA Differential Privacy Federated Learning Scheme Based on Adaptive Gaussian Noise
Jiao, S., Cai, L., Wang, X., Cheng, K., & Gao, X. (2023) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2023.030512 · Cited by 13 · see citing works
Azadmanesh, M., Ghahfarokhi, B. S., & Talouki, M. A. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.125646 · Cited by 5 · see citing works
On the Vulnerability of Data Points Under Multiple Membership Inference Attacks and Target Models
Conti, M., Li, J., & Picek, S. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3543093 · Cited by 4 · see citing works
Privacy in Generative Models: Attacks and Defense Mechanisms
Azadmanesh, M., Ghahfarokhi, B. S., & Talouki, M. A. (2024) · Springer eBooks · doi:10.1007/978-3-031-46238-2_4 · Cited by 3 · see citing works
Balancing Privacy and Robustness in Prompt Learning for Large Language Models
Shi, C., Su, J., Chu, C., Wang, B., & Feng, D. (2024) · Mathematics · doi:10.3390/math12213359 · Cited by 3 · see citing works
A Method for Privacy-Safe Synthetic Health Data
Luo, X. (2024) · Academic Journal of Science and Technology · doi:10.54097/f7fjss40 · Cited by 1 · see citing works
Adversarial for Good – Defending Training Data Privacy with Adversarial Attack Wisdom
Pang, S., Chen, Y., Deng, J., Wu, J., Bai, Y., & Xu, W. (2024) · IEEE International Conference on Metaverse Computing, Networking and Applications (MetaCom) · doi:10.1109/metacom62920.2024.00040 · Cited by 1 · see citing works
Protecting Multiple Sensitive Attributes in Synthetic Micro-data
Niederhametner, N., & Mayer, R. L. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386296
GAN-based medical image synthesis: A lineage-aware security survey
Abdulraheem, A., Suleiman, J. T., Jung, I. Y., & Lee, T. (2026) · Intelligent Systems with Applications · doi:10.1016/j.iswa.2026.200696
- Authors
- Hu, H., & Pang, J.
- Affiliations
- University of Luxembourg (LU)
- ORCID
- Venue
- Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2021-11-12
- Pages
- 2387-2389
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W3213187311
- Cited by
- 16
- References
- 14
- Citations by year
- 2026: 1 · 2025: 2 · 2024: 7 · 2023: 6
- FWCI
- 1.50
- Type
- conference paper
- Language
- en
- Open access
- green
- orbilu.uni.lu
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Open Repository and Bibliography (University of Luxembourg) (submittedVersion, other-oa)
- Funders
- Luxembourg National Research Fund (13550291)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, generative adversarial networks, privacy leakage, privacy risk assessment
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
