privGAN: Protecting GANs from membership inference attacks at low cost to utility

Abstract

Generative Adversarial Networks (GANs) have made releasing of synthetic images a viable approach to share data without releasing the original dataset. It has been shown that such synthetic data can be used for a variety of downstream tasks such as training classifiers that would otherwise require the original dataset to be shared. However, recent work has shown that the GAN models and their synthetically generated data can be used to infer the training set membership by an adversary who has access to the entire dataset and some auxiliary information. Current approaches to mitigate this problem (such as DPGAN [1]) lead to dramatically poorer generated sample quality than the original non–private GANs. Here we develop a new GAN architecture (privGAN), where the generator is trained not only to cheat the discriminator but also to defend membership inference attacks. The new mechanism is shown to empirically provide protection against this mode of attack while leading to negligible loss in downstream performances. In addition, our algorithm has been shown to explicitly prevent memorization of the training set, which explains why our protection is so effective. The main contributions of this paper are: i) we propose a novel GAN architecture that can generate synthetic data in a privacy preserving manner with minimal hyperparameter tuning and architecture selection, ii) we provide a theoretical understanding of the optimal solution of the privGAN loss function, iii) we empirically demonstrate the effectiveness of our model against several white and black–box attacks on several benchmark datasets, iv) we empirically demonstrate on three common benchmark datasets that synthetic images generated by privGAN lead to negligible loss in downstream performance when compared against non– private GANs. While we have focused on benchmarking privGAN exclusively on image datasets, the architecture of privGAN is not exclusive to image datasets and can be easily extended to other types of datasets. Repository link: https://github.com/microsoft/privGAN.

Causally Constrained Data Synthesis for Private Data Release

“…We observe that the adversary's advantage is reduced to varying degrees across both datasets. This suggests that DP training is a reliable defense against adversary's of this nature (Mukherjee et al, 2019;Bhowmick et al, 2018), despite having a higher range of ε values (as shown in Table 1). The detailed MI accuracy numbers with precision and recall are in Appendix F.…”

“…Utilizing synthetic data generated by generative adversarial networks (GANs) for various problem domains has been extensively studied, but only few solutions provide formal guarantees of privacy (Jordon et al, 2018;Harder et al, 2020;Torkzadehmahani et al, 2019;Ma et al, 2020b;Tantipongpipat et al, 2019;Xin et al, 2020;Long et al, 2019;Liu et al, 2019). Across the spectrum, very limited techniques are evaluated against adversaries (Mukherjee et al, 2019).…”

“…However, naive data creation may not work; when improperly constructed, the synthetic data can leak information about its sensitive counterpart (from which it was constructed). Several membership and attribute inference attacks have been shown to impact specific subgroups (Mukherjee et al, 2019;Stadler et al, 2020;Zhang et al, 2020b), and eliminate any privacy advantage provided by releasing synthetic data. Therefore, efficient privacy-preserving synthetic data generation methods are needed.…”

Private data sharing between decentralized users through the privGAN architecture

“…PrivGAN [6] is an extension of GAN whose development has lead to notoriously realistic synthetic images. In their original version, GANs comprise a generator G and a discriminator D playing a two-player game as shown in Fig.…”

“…Motivated by real world use cases such as the banks in Fig. 1, we modified the original privGAN [6] prescription to create disjoint subsets of varying sizes. Another notable difference with the original privGAN is the exclusion of a pre-training of the central discriminator on the real data since the whole point of this work is to circumvent the real data access limitations.…”