The DOI matches its Crossref record; 62 of the 64 references it cites were found in a registry or an index.
LOGAN: Membership Inference Attacks Against Generative Models
Open accessAbstract
Generative models estimate the underlying distribution of a dataset to generate realistic samples according to that distribution. In this paper, we present the first membership inference attacks against generative models: given a data point, the adversary determines whether or not it was used to train the model. Our attacks leverage Generative Adversarial Networks (GANs), which combine a discriminative and a generative model, to detect overfitting and recognize inputs that were part of training datasets, using the discriminator’s capacity to learn statistical differences in distributions. We present attacks based on both white-box and black-box access to the target model, against several state-of-the-art generative models, over datasets of complex representations of faces (LFW), objects (CIFAR-10), and medical images (Diabetic Retinopathy). We also discuss the sensitivity of the attacks to different training parameters, and their robustness against mitigation strategies, finding that defenses are either ineffective or lead to significantly worse performances of the generative models in terms of training stability and/or sample quality.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Formal security and secrecy mechanisms such as model encryption can only partially address this requirement, as even encrypted models have been found to leak sensitive information in previous work23,24.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [24]
Citations
Cites
(2014) · Cited by 33,419
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
Ioffe, S., & Szegedy, C. (2015) · arXiv · doi:10.48550/arxiv.1502.03167 · Cited by 27,818
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 20,507
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate ShiftPreprint
Ioffe, S. (2024) · arXiv (Cornell University) · doi:10.57702/o9raffed · Cited by 15,273
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Distilling the Knowledge in a Neural Network
Hinton, G., Vinyals, O., & Dean, J. (2015) · arXiv · doi:10.48550/arxiv.1503.02531 · Cited by 14,204
Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network
Ledig, C., Theis, L., Huszar, F., Caballero, J., Cunningham, A., Acosta, A., Aitken, A., Tejani, A., Totz, J., Wang, Z., et al. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.19 · Cited by 12,696
Unsupervised representation learning with deep convolutional generative adversarial networks
Radford, A., Metz, L., & Chintala, S. (2015) · arXiv · doi:10.48550/arxiv.1511.06434 · Cited by 12,235
Improved Techniques for Training GANs
Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., & Chen, X. (2016) · arXiv · doi:10.48550/arxiv.1606.03498 · Cited by 6,965
Improved training of Wasserstein GANs
Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., & Courville, A. (2017) · arXiv · doi:10.48550/arxiv.1704.00028 · Cited by 6,800
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956
Differential Privacy: A Survey of Results
Dwork, C. (2008) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-79228-4_1 · Cited by 3,542
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,251
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Privacy-preserving deep learning
Shokri, R., & Shmatikov, V. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813687 · Cited by 2,356
Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural NetworksPreprint
Salimans, T., & Kingma, D. P. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1602.07868 · Cited by 1,551
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377
Semantic Image Inpainting with Deep Generative Models
Yeh, R. A., Chen, C., Lim, T. Y., Schwing, A. G., Hasegawa‐Johnson, M., & Do, M. N. (2017) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2017.728 · Cited by 1,348
De-anonymizing Social Networks
Narayanan, A., & Shmatikov, V. (2009) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2009.22 · Cited by 1,324
Autoencoding beyond pixels using a learned similarity metric
Larsen, A., Sønderby, S. K., Larochelle, H., & Winther, O. (2016) · Research at the University of Copenhagen (University of Copenhagen) · Cited by 1,317
(2016) · International Conference on Machine Learning · Cited by 1,270
Homer, N., Szelinger, S., Redman, M., Duggan, D., Tembe, W., Muehling, J., Pearson, J. V., Stephan, D. A., Nelson, S. F., & Craig, D. W. (2008) · PLoS Genetics · doi:10.1371/journal.pgen.1000167 · Cited by 1,221
BEGAN: Boundary Equilibrium Generative Adversarial NetworksPreprint
Berthelot, D., Schumm, T., & Metz, L. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.10717 · Cited by 1,184
Privacy Preserving Data Mining
Lindell, Y., & Pinkas, B. (2000) · Lecture Notes in Computer Science · doi:10.1007/3-540-44598-6_3 · Cited by 1,077
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001
Are GANs Created Equal? A Large-Scale StudyPreprint
Lučić, M., Kurach, K., Michalski, M., Gelly, S., & Bousquet, O. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.10337 · Cited by 865
Lossy Image Compression with Compressive AutoencodersPreprint
Theis, L., Shi, W., Cunningham, A., & Huszár, F. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.00395 · Cited by 814
Autoencoding beyond pixels using a learned similarity metricPreprint
Larsen, A., Sønderby, S. K., Larochelle, H., & Winther, O. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1512.09300 · Cited by 813
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796
Medical Image Synthesis with Context-Aware Generative Adversarial Networks
Nie, D., Trullo, R., Lian, J., Petitjean, C., Ruan, S., Wang, Q., & Shen, D. G. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66179-7_48 · Cited by 772
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658
Machine Learning Models that Remember Too Much
Song, C., Ristenpart, T., & Shmatikov, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134077 · Cited by 526
Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., & Felici, G. (2015) · International Journal of Security and Networks · doi:10.1504/ijsn.2015.071829 · Cited by 518
Machine Learning with Membership Privacy using Adversarial Regularization
Nasr, M., Shokri, R., & Houmansadr, A. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243855 · Cited by 458
Privacy-Preserving Generative Deep Neural Networks Support Clinical Data Sharing
Beaulieu‐Jones, B. K., Wu, Z. S., Williams, C., Lee, R., Bhavnani, S. P., Byrd, J. B., & Greene, C. S. (2019) · Circulation Cardiovascular Quality and Outcomes · doi:10.1161/circoutcomes.118.005122 · Cited by 430
Privacy-Preserving Multivariate Statistical Analysis: Linear Regression and Classification
Du, W. K., Han, Y. S., & Chen, S. (2004) · SIAM International Conference on Data Mining · doi:10.1137/1.9781611972740.21 · Cited by 376
Scalable Private Learning with PATE
Papernot, N., Song, S., Mironov, I., Raghunathan, A., Talwar, K., & Erlingsson, Ú. (2018) · arXiv · doi:10.48550/arxiv.1802.08908 · Cited by 373
Generalized Denoising Auto-Encoders as Generative Models
Bengio, Y., Yao, L., Alain, G., & Vincent, P. (2013) · arXiv · doi:10.48550/arxiv.1305.6663 · Cited by 324
"You Might Also Like:" Privacy Risks of Collaborative Filtering
Calandrino, J. A., Kilzer, A., Narayanan, A., Felten, E. W., & Shmatikov, V. (2011) · 2011 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2011.40 · Cited by 311
Duchi, J. C., Jordan, M. I., & Wainwright, M. J. (2014) · Journal of the ACM · doi:10.1145/2666468 · Cited by 254
Lossy Image Compression with Compressive Autoencoders
Huszár, F., Theis, L., Shi, W., & Cunningham, A. (2020) · Apollo (University of Cambridge) · doi:10.17863/cam.51995 · Cited by 237
Knock Knock, Who's There? Membership Inference on Aggregate Location Data
Pyrgelis, A., Troncoso, C., & Cristofaro, E. D. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23183 · Cited by 232
On the Quantitative Analysis of Decoder-Based Generative ModelsPreprint
Wu, Y., Burda, Y., Salakhutdinov, R., & Grosse, R. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.04273 · Cited by 181
Privacy-Preserving Deep Learning: Revisited and Enhanced
Phong, L. T., Aono, Y., Hayashi, T., Wang, L., & Moriai, S. (2017) · Communications in computer and information science · doi:10.1007/978-981-10-5421-1_9 · Cited by 170
Membership Inference Attack against Differentially Private Deep Learning Model.
Rahman, M. A., Rahman, T., Laganière, R., & Mohammed, N. (2018) · Cited by 167
Generalization in Adaptive Data Analysis and Holdout Reuse
Dwork, C., Feldman, V., Hardt, M., Pitassi, T., Reingold, O., & Roth, A. (2015) · arXiv · doi:10.48550/arxiv.1506.02629 · Cited by 152
Membership Privacy in MicroRNA-based Studies
Michael Backes, A., Berrang, P., Humbert, M., & Manoharan, P. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978355 · Cited by 134
The Secret Sharer: Measuring Unintended Neural Network Memorization & Extracting SecretsPreprint
Carlini, N., Liu, C., Kos, J., Erlingsson, Ú., & Song, D. X. (2018) · arXiv (Cornell University) · Cited by 124
AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine LearningPreprint
Jia, J., & Gong, N. Z. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.04810 · Cited by 119
De-anonymizing social networks and inferring private attributes using knowledge graphs
Qian, J., Li, X., Zhang, C., & Chen, L. (2016) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2016.7524578 · Cited by 101
Privacy-preserving generative deep neural networks support clinical data sharingPreprint
Beaulieu‐Jones, B. K., Wu, Z. S., Williams, C., et al. (2017) · bioRxiv (Cold Spring Harbor Laboratory) · doi:10.1101/159756 · Cited by 89
Ji, S., Li, W., Gong, N. Z., Mittal, P., & Beyah, R. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23096 · Cited by 88
Towards Demystifying Membership Inference AttacksPreprint
Truex, S., Liu, L., Gürsoy, M. E., Yu, L., & Wei, W. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.09173 · Cited by 84
Privacy Aware LearningPreprint
Duchi, J. C., Jordan, M. I., & Wainwright, M. J. (2012) · arXiv (Cornell University) · doi:10.48550/arxiv.1210.2085 · Cited by 61
What Does The Crowd Say About You? Evaluating Aggregation-based Location Privacy
Pyrgelis, A., Troncoso, C., & Cristofaro, E. D. (2017) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2017-0043 · Cited by 56
Generating Multi-label Discrete Electronic Health Records using Generative Adversarial Networks.Preprint
Choi, E., Biswal, S., Malin, B., Duke, J. D., Stewart, W. F., & Sun, J. (2017) · arXiv (Cornell University) · Cited by 40
Differentially Private Bayesian OptimizationPreprint
Kusner, M. J., Gardner, J. R., Garnett, R., & Weinberger, K. Q. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1501.04080 · Cited by 32
Revisiting Differentially Private Regression: Lessons From Learning Theory and their ConsequencesPreprint
Wu, X., Fredrikson, M., Wu, W., Jha, S., & Naughton, J. F. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1512.06388 · Cited by 18
Research works printed but not linked: 8
- [3] M. Arjovsky, S. Chintala, and L. Bottou. Wasserstein GAN. arXiv 1701.07875, 2017. · arXiv
- [20] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial nets. In NIPS, 2014.
- [31] D. P. Kingma and M. Welling. Auto-Encoding Variational Bayes. In ICLR, 2013.
- [37] Y. Long, V. Bindschaedler, L. Wang, D. Bu, X. Wang, H. Tang, C. A. Gunter, and K. Chen. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv:1802.04889, 2018. · arXiv
- [41] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov. Inference Attacks Against Collaborative Learning. arXiv:1805.04049, 2018. · arXiv
- [46] N. Papernot, M. Abadi, Ú. Erlingsson, I. Goodfellow, and K. Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In ICLR, 2017.
- [62] A. Triastcyn and B. Faltings. Generating differentially private datasets using gans. arXiv preprint arXiv:1803.03148, 2018. · arXiv
- [67] X. Wu and X. Zhang. Automated Inference on Criminality using Face Images. arXiv 1611.04135, 2016. · arXiv
Cited by
Sorted by citations
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
Self-citationA survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., & Zhang, Y. (2024) · High-Confidence Computing · doi:10.1016/j.hcc.2024.100211 · Cited by 1,083
Membership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 662
Membership Inference Attacks From First Principles
Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., & Tramèr, F. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833649 · Cited by 728
When Machine Learning Meets Privacy: A Survey and Outlook
Liu, B., Ding, M., Shaham, S., Rahayu, W., Farokhi, F., & Lin, Z. (2022) · ACM Computing Surveys · doi:10.1145/3436755 · Cited by 455
Metadata
- Authors
- Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E.
- Affiliations
- University College London (GB)
- University College London
- Venue
- Proceedings on Privacy Enhancing Technologies
- Published
- 2018-12-24
- Volume
- 2019
- Issue
- 1
- Pages
- 133-152
- ISSN
- 2299-0984 (ISSN-L)
- OpenAlex
- W2887995258
- Cited by
- 433
- References
- 64
- Citations by year
- 2026: 31 · 2025: 46 · 2024: 62 · 2023: 74 · 2022: 69 · 2021: 68 · 2020: 54 · 2019: 27 · 2018: 2
- FWCI
- 21.13
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Proceedings on Privacy Enhancing Technologies (publishedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, generative models, generative adversarial networks, privacy attacks, overfitting detection, black-box attacks, white-box attacks, defense robustness, training data privacy, medical image privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
