The DOI matches its Crossref record; 62 of the 64 references it cites were found in a registry or an index.
LOGAN: Membership Inference Attacks Against Generative Models
Open accessAbstract
Generative models estimate the underlying distribution of a dataset to generate realistic samples according to that distribution. In this paper, we present the first membership inference attacks against generative models: given a data point, the adversary determines whether or not it was used to train the model. Our attacks leverage Generative Adversarial Networks (GANs), which combine a discriminative and a generative model, to detect overfitting and recognize inputs that were part of training datasets, using the discriminator’s capacity to learn statistical differences in distributions. We present attacks based on both white-box and black-box access to the target model, against several state-of-the-art generative models, over datasets of complex representations of faces (LFW), objects (CIFAR-10), and medical images (Diabetic Retinopathy). We also discuss the sensitivity of the attacks to different training parameters, and their robustness against mitigation strategies, finding that defenses are either ineffective or lead to significantly worse performances of the generative models in terms of training stability and/or sample quality.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Formal security and secrecy mechanisms such as model encryption can only partially address this requirement, as even encrypted models have been found to leak sensitive information in previous work23,24.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [24]
Citations
Cites
(2014) · Cited by 33,419
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
Ioffe, S., & Szegedy, C. (2015) · arXiv · doi:10.48550/arxiv.1502.03167 · Cited by 27,818
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 20,507
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate ShiftPreprint
Ioffe, S. (2024) · arXiv (Cornell University) · doi:10.57702/o9raffed · Cited by 15,273
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Distilling the Knowledge in a Neural Network
Hinton, G., Vinyals, O., & Dean, J. (2015) · arXiv · doi:10.48550/arxiv.1503.02531 · Cited by 14,204
Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network
Ledig, C., Theis, L., Huszar, F., Caballero, J., Cunningham, A., Acosta, A., Aitken, A., Tejani, A., Totz, J., Wang, Z., et al. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.19 · Cited by 12,696
Unsupervised representation learning with deep convolutional generative adversarial networks
Radford, A., Metz, L., & Chintala, S. (2015) · arXiv · doi:10.48550/arxiv.1511.06434 · Cited by 12,235
Improved Techniques for Training GANs
Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., & Chen, X. (2016) · arXiv · doi:10.48550/arxiv.1606.03498 · Cited by 6,965
Research works printed but not linked: 8
- [3] M. Arjovsky, S. Chintala, and L. Bottou. Wasserstein GAN. arXiv 1701.07875, 2017. · arXiv
- [20] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial nets. In NIPS, 2014.
- [31] D. P. Kingma and M. Welling. Auto-Encoding Variational Bayes. In ICLR, 2013.
- [37] Y. Long, V. Bindschaedler, L. Wang, D. Bu, X. Wang, H. Tang, C. A. Gunter, and K. Chen. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv:1802.04889, 2018. · arXiv
- [41] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov. Inference Attacks Against Collaborative Learning. arXiv:1805.04049, 2018. · arXiv
- [46] N. Papernot, M. Abadi, Ú. Erlingsson, I. Goodfellow, and K. Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In ICLR, 2017.
- [62] A. Triastcyn and B. Faltings. Generating differentially private datasets using gans. arXiv preprint arXiv:1803.03148, 2018. · arXiv
- [67] X. Wu and X. Zhang. Automated Inference on Criminality using Face Images. arXiv 1611.04135, 2016. · arXiv
Cited by
Sorted by citations
Items 401–432 of 432
Generalization and Memorization in Rectified Flow
Rao, M., & Moyer, D. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-37383-0_31 · Cited by 2
Evaluating Privacy and Utility of Synthetic Tabular Data with Membership Inference Attacks
Ismalej, B., Ruan, X., & Jiang, X. (2025) · IEEE International Conference on Future Machine Learning and Data Science (FMLDS) · doi:10.1109/fmlds67896.2025.00017
Privacy Preserved and Explainable Deep Medical Image Analysis: A Survey
Chowdhury, L., Thuseethan, S., Sebastian, Y., Rajasegarar, S., Alazab, M., & Yearwood, J. L. (2026) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2026.3675200
Evaluation of Deep Image Generation Through the Lens of Privacy and Utility
Webster, R. (2023) · theses.fr (ABES) · doi:10.70675/51327419zb5cbz4c00zb7aez9165372626fc
Leakage of Sensitive Data from Deep Neural Networks
Grosso, G. D. (2023) · theses.fr (ABES) · doi:10.70675/4750e977z8d15z41fez8542z9899c2e11952
RogueGPT : Unleashing Jailbreak Prompts on LLMs
Shivaswaroopa, A., Sood, V., Gururaj, H. L., Shreyas, J., & Al-Turjman, F. M. (2026) · Engineering Reports · doi:10.1002/eng2.70069 · Cited by 2
Quantifying Privacy Risks in Synthetic Data: A Study on Black-Box Membership Inference
Fantino, G., Rondina, M., Vetrò, A., & Martin, J. C. D. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-22774-4_5
Uncovering Privacy Risks in Timegan: Novel and Effective Membership Inference Attacks
Zhang, N., Long, C., Li, J., Yang, F., Fu, Y., Pan, X., Wan, W., & Ma, W. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11464964
Synthetic Sales Data Generation for Chilean SMEs Using GANs
Ruete, D., Duran-Riveros, M., Maldonado-Duran, S., Caroca, A., Taramasco, C., Leal, D., Caselli, N., Reyes, M., Salinas, O., Mellado, D., et al. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-16758-3_5
Lost in the Averages: Reassessing Record-Specific Privacy Risk Evaluation
Krčo, N., Guépin, F., Meeus, M., Kulynych, B., & de Montjoye, Y.-A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-16089-8_2
Hybrid-DP Diffusion for Privacy-Preserving Wi-Fi CSI Sensing and Biometric Template Generation
Hu, B., Lu, C., Kwak, D., Lei, J., Xu, M., You, J., & Feng, Y. (2026) · IEEE Sensors Journal · doi:10.1109/jsen.2026.3690368
Lengl, M., Schumann, S., Röhrl, S., Knopp, M., Hayden, O., & Diepold, K. J. (2025) · International Conference on Biomedical and Bioinformatics Engineering (ICBBE) · doi:10.1145/3794209.3794219
A Human-Centered Privacy (HCP) Approach to AI
Sun, L., Xu, W., & Gao, Z. (2026) · Springer eBooks · doi:10.1007/978-981-95-3658-0_116
Javaid, K., Yuan, M., & Cui, Y. (2026) · Knowledge-Based Systems · doi:10.1016/j.knosys.2026.116515
Non-intrusive copyright auditing in DNN-based AI systems: A lifecycle-oriented survey
Chen, H., Ye, F., Shao, B., Chang, W., Jin, J., Mao, X., & Huang, C. (2026) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2026.07.001
TabDDPM-Aug: Adaptive diffusion-based hybrid augmentation for imbalanced tabular classification
Ahmed, T., & Rehman, J. U. (2026) · Expert Systems with Applications · doi:10.1016/j.eswa.2026.133689
Identifying and Protecting Records at Risk for Membership Inference Attacks Against Synthetic Data
Niederhametner, N., & Mayer, R. L. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-33260-8_27
A Single-Protocol Privacy-Utility Comparison of Conditional Generative Augmentation
Fan, Z., Li, Y., Zhuang, Z., & Yang, Q. (2026) · International Conference on Machine Learning and Intelligent Systems Engineering (MLISE) · doi:10.1109/mlise70044.2026.11607547
Partial Privacy for Sensitive Subsets in Deep Learning Models
Shateri, M., & Sayedana, B. (2026) · Conference proceedings - Canadian Conference on Electrical and Computer Engineering · doi:10.1109/ccece68150.2026.11610092
TuneMIA: Membership Inference Attack on Latent Diffusion Models
Azulay, N., Habler, E., Shabtai, A., & Elovici, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-31583-0_13
The Privacy–Utility Trade-Off in Brain MRI Synthesis: A Comparative Framework for Generative Models
Ninh, D. T., Kien, N. D., Huynh, T. N., Anh, L. Q., Dinh, T. H., Manh, B. D., Anh, N. H., D’haeseleer, M., Schependom, J. V., Denissen, S., et al. (2026) · Communications in computer and information science · doi:10.1007/978-981-92-2600-9_31
Ibrahim, B. S., shakir, A. H., & Jameel, H. (2026) · Al-Noor Journal of Engineering Management and Computer Science · doi:10.71229/v37bk664
The Co-Evolution of AI and Cybersecurity: Attacks, Defenses, and Future Directions
Picek, S., & Jakobović, D. (2026) · Genetic and Evolutionary Computation Conference Companion (GECCO Companion) · doi:10.1145/3795101.3807757
Hassan, R., & Fathy, D. (2026) · Journal of Artificial Intelligence for Healthcare Systems · doi:10.68159/r206901001
Which Genes Leak? Feature-Level Privacy Auditing for Synthetic Single-Cell RNA-Seq Data
Feng, S., Feng, B., & Geng, B. (2026) · IEEE International Conference on Information Reuse and Integration (IRI) · doi:10.1109/iri69576.2026.00036
FDCTGAN: Client-local CTGAN-augmented federated learning for imbalanced breast cancer classification
Salehpour, A., Balafar, M. A., & Souri, A. (2026) · Technology and Health Care · doi:10.1177/09287329261484379
Membership Inference Attacks on In-Context Learning Recommendation
He, J., Chen, M.-C., Chen, X., Fang, X., Gu, Y., & Chen, K. (2026) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3773078.3831733 · Cited by 1
Security and Privacy Issues in Deep Learning
Bae, H., Jang, J., Jung, D., Jang, H., Ha, H., Lee, H., & Yoon, S. (2018) · arXiv · doi:10.48550/arxiv.1807.11655 · Cited by 56
Eavesdrop the Composition Proportion of Training Labels in Federated Learning
Wang, L., Xu, S., Wang, X., & Zhu, Q. (2019) · arXiv · doi:10.48550/arxiv.1910.06044 · Cited by 34
Metadata
- Authors
- Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E.
- Affiliations
- University College London (GB)
- University College London
- Venue
- Proceedings on Privacy Enhancing Technologies
- Published
- 2018-12-24
- Volume
- 2019
- Issue
- 1
- Pages
- 133-152
- ISSN
- 2299-0984 (ISSN-L)
- OpenAlex
- W2887995258
- Cited by
- 433
- References
- 64
- Citations by year
- 2026: 31 · 2025: 46 · 2024: 62 · 2023: 74 · 2022: 69 · 2021: 68 · 2020: 54 · 2019: 27 · 2018: 2
- FWCI
- 21.13
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Proceedings on Privacy Enhancing Technologies (publishedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, generative models, generative adversarial networks, privacy attacks, overfitting detection, black-box attacks, white-box attacks, defense robustness, training data privacy, medical image privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
