论文标题
关于GAN生成样品的隐私属性
On the Privacy Properties of GAN-generated Samples
论文作者
论文摘要
生成对抗网络（GAN）的隐私影响是一个引起人们关注的话题，导致了最近的几种具有隐私保证的剂量培训gan的算法。通过与甘恩斯的概括属性建立连接，我们证明，在某些假设下，甘恩生成的样本固有地满足了某些（弱）的隐私保证。首先，我们表明，如果在M样品上对GAN进行了训练并用于生成N样品，则生成的样品为（Epsilon，delta） - 差异为（Epsilon，Delta）对，其中Delta量表为O（N/M）。我们表明，在某些特殊条件下，这种上限很紧。接下来，我们研究了GAN生成的样品的鲁棒性，以成员推理攻击。我们将成员的推论建模为假设检验，在该测试中，对手必须确定是从训练数据集还是从基础数据分布中汲取给定样本的。我们表明，这个对手可以在ROC曲线下实现一个区域，该区域的缩放范围不比O（M^{ - 1/4}）更好。
The privacy implications of generative adversarial networks (GANs) are a topic of great interest, leading to several recent algorithms for training GANs with privacy guarantees. By drawing connections to the generalization properties of GANs, we prove that under some assumptions, GAN-generated samples inherently satisfy some (weak) privacy guarantees. First, we show that if a GAN is trained on m samples and used to generate n samples, the generated samples are (epsilon, delta)-differentially-private for (epsilon, delta) pairs where delta scales as O(n/m). We show that under some special conditions, this upper bound is tight. Next, we study the robustness of GAN-generated samples to membership inference attacks. We model membership inference as a hypothesis test in which the adversary must determine whether a given sample was drawn from the training dataset or from the underlying data distribution. We show that this adversary can achieve an area under the ROC curve that scales no better than O(m^{-1/4}).
