论文标题
自由骑士在多歧视者gan中的攻击和防御
Attacks and Defenses for Free-Riders in Multi-Discriminator GAN
论文作者
论文摘要
行业越来越多地采用生成的对抗网络（GAN）来综合逼真的图像。由于数据无法集中可用，因此多歧视器（MD） - GANS培训框架采用了多个可以直接访问真实数据的歧视器。分布进行培训的联合GAN模型需要自由骑士的风险，即旨在从共同模型中受益的同时仅假装参加培训过程的参与者。在本文中，我们对自由骑士对MD-GAN的影响进行了首次表征研究。基于MD-GAN的两个生产原型，我们发现自由骑士大大降低了MD-GAN产生与真实数据无法区分的图像的能力，即它们增加了FID分数 - 评估生成图像质量的标准度量。为了减轻模型退化，我们提出了针对MD-GAN的自由骑士的防御策略，称为DFG。 DFG通过自由骑行者的参考响应对歧视者的响应进行定期探测和聚类来区分自由骑士和良性参与者，然后允许生成器将所检测到的自由骑士排除在培训中。此外，我们扩展了称为DFG+的防御，以使歧视者能够在MD-GAN的变体中滤除自由骑机，从而允许歧视者网络的同行交换。对自由骑士，MD-GAN体系结构和三个数据集的各种情况进行了广泛的评估表明，我们的防御能力有效地检测了自由骑士。与没有防御的攻击相比，CIFAR10的DFG和DFG+平均降低了5.22％，CIFAR10的DFG和DFG+的FID降低了5.22％，至13.22％。在外壳中，拟议的DFG（+）可以有效地防御自由骑士，而不会在可忽略的计算开销中影响良性客户。
Generative Adversarial Networks (GANs) are increasingly adopted by the industry to synthesize realistic images. Due to data not being centrally available, Multi-Discriminator (MD)-GANs training framework employs multiple discriminators that have direct access to the real data. Distributedly training a joint GAN model entails the risk of free-riders, i.e., participants that aim to benefit from the common model while only pretending to participate in the training process. In this paper, we conduct the first characterization study of the impact of free-riders on MD-GAN. Based on two production prototypes of MD-GAN, we find that free-riders drastically reduce the ability of MD-GANs to produce images that are indistinguishable from real data, i.e., they increase the FID score -- the standard measure to assess the quality of generated images. To mitigate the model degradation, we propose a defense strategy against free-riders in MD-GAN, termed DFG. DFG distinguishes free-riders and benign participants through periodic probing and clustering of discriminators' responses based on a reference response of free-riders, which then allows the generator to exclude the detected free-riders from the training. Furthermore, we extend our defense, termed DFG+, to enable discriminators to filter out free-riders at the variant of MD-GAN that allows peer exchanges of discriminators networks. Extensive evaluation on various scenarios of free-riders, MD-GAN architecture, and three datasets show that our defenses effectively detect free-riders. With 1 to 5 free-riders, DFG and DFG+ averagely decreases FID by 5.22% to 11.53% for CIFAR10 and 5.79% to 13.22% for CIFAR100 in comparison to an attack without defense. In a shell, the proposed DFG(+) can effectively defend against free-riders without affecting benign clients at a negligible computation overhead.
