PaperlayerView exact revision on arXiv

Source-linked AI summary

Reconstruction and Membership Inference Attacks against Generative Models

Benjamin Hilprecht, Martin Härterich, Daniel Bernau

arXiv:1906.03006v1cs.CRcs.LG

TL;DR

The paper addresses how to detect whether generative models expose information about individual records or specific training datasets. It proposes model-agnostic and VAE-specific attacks, evaluates them on GANs and VAEs, and finds strong attack performance, especially against VAEs. The findings support using these attacks to assess leakage and overfitting while motivating GANs as less vulnerable models.

  • Problem

    Existing membership inference work focuses largely on single records and specialized generative-model attacks, limiting privacy auditing of dataset use across generative architectures.

  • Method

    The paper proposes a model-agnostic Monte Carlo attack, a VAE-specific Reconstruction attack, and set membership inference for regulatory actors, under limited access assumptions.

  • Results

    The attacks generally outperform prior generative-model attacks, with Reconstruction reaching approximately 100% single and set MI on CIFAR-10 and VAEs more vulnerable than GANs.

  • Takeaways & Limitations

    The attacks can help evaluate overfitting and information leakage, while the results motivate using GANs because they are less vulnerable and produce detailed samples.

  • Takeaways & Limitations

    The MC attack depends on observing replicated training-data characteristics, so it can underperform when generated sample quality is very poor.

Abstract

from arXiv · show

We present two information leakage attacks that outperform previous work on membership inference against generative models. The first attack allows membership inference without assumptions on the type of the generative model. Contrary to previous evaluation metrics for generative models, like Kernel Density Estimation, it only considers samples of the model which are close to training data records. The second attack specifically targets Variational Autoencoders, achieving high membership inference accuracy. Furthermore, previous work mostly considers membership inference adversaries who perform single record membership inference. We argue for considering regulatory actors who perform set membership inference to identify the use of specific datasets for training. The attacks are evaluated on two generative model architectures, Generative Adversarial Networks (GANs) and Variational Autoencoders (VAEs), trained on standard image datasets. Our results show that the two attacks yield success rates superior to previous work on most data sets while at the same time having only very mild assumptions. We envision the two attacks in combination with the membership inference attack type formalization as especially useful. For example, to enforce data privacy standards and automatically assessing model quality in machine learning as a service setups. In practice, our work motivates the use of GANs since they prove less vulnerable against information leakage attacks while producing detailed samples.

1 Introduction

The paper introduces two membership inference attacks for generative models and expands the threat model from identifying individual records to auditing whether specific datasets were used. Across image datasets, the attacks generally outperform prior approaches, with VAEs especially vulnerable and GANs less vulnerable.

  • The paper addresses privacy risks from training-data misuse by studying model inversion and membership inference for generative models.
  • The authors distinguish adversaries performing single-record membership inference from regulators performing set membership inference to identify unauthorized dataset use.
  • The proposed attacks include a Monte Carlo attack using only small-distance model samples, a VAE-specific Reconstruction attack, and a set-membership inference formulation.
  • The attacks are evaluated on GANs and VAEs trained on MNIST, Fashion-MNIST, and CIFAR-10.
  • For VAEs, Reconstruction attack accuracy is close to 100% for set MI and ranges from 57% to 99% for single MI.
  • The MC attack reaches 72%–100% set MI accuracy and up to 60% single MI accuracy, while GAN set MI accuracy ranges from 65% to 75%.The MC attack performs better when generated samples have high quality.

2 Membership Inference Attacks

This section formalizes membership inference against generative models through single-record and set-based tasks, specifying the actors, assumptions, attack inputs, and regulatory decision procedure.

  • Membership inference gathers evidence about whether a record or set of records belongs to a model’s training dataset and is linked to overfitting.
  • The paper defines single MI as identifying individual training records from a balanced mixture of training and test records.
  • The two actors lack access to the underlying training dataset; MC requires generated samples, whereas Reconstruction requires model evaluation access.
  • Set MI is designed for regulatory audits because it can provide evidence that a specific dataset was illegally used to train a model.
  • In single MI, the adversary computes f̂(x) for each record and labels the M records with the highest values as training data.
  • Set MI asks a regulator to determine which of two same-sized record sets is a subset of the model’s training data.
  • The regulator selects the set containing most of the M records with the highest f̂(x) values, with ties resolved randomly.
  • Both MI settings assume equal numbers of training and test records, although regulators can sample the larger set when sizes differ.

3 Attack Details

The paper introduces Monte Carlo and Reconstruction membership inference attacks for single-record and set inference. The Monte Carlo attack uses only samples close to records, while the Reconstruction attack applies VAE reconstruction loss to membership inference.

  • Attack overview: The attacks support both single and set membership inference by comparing model samples with train or test records.Set membership inference is intended to identify whether a suspected dataset was used for training.
  • Monte Carlo attack: The Monte Carlo attack is applicable to generative models that can produce samples and estimates membership using samples close to a record.Samples whose distance from the record exceeds ε are ignored in the distance-threshold variant.
  • Monte Carlo attack: The Monte Carlo attack has two variants: one ignores samples beyond ε, while the other incorporates exact distances and logarithmic weighting.Both variants use an estimation function whose higher values indicate likely training records.
  • Monte Carlo attack: Kernel Density Estimation performs no better than random guessing in the evaluated attack variation, whereas the proposed attacks focus exclusively on samples significantly close to training data.The paper treats distance-function choice as important for attack success.
  • Reconstruction attack: The Reconstruction attack applies VAE reconstruction loss as the discriminating function for membership inference.It averages negative reconstruction distances over latent samples drawn from the encoder’s Gaussian distribution.

4 Evaluation

The evaluation compares the proposed attacks with prior white- and black-box attacks across GANs and VAEs trained on standard image datasets. The proposed methods generally outperform prior attacks on simpler datasets, while performance depends on architecture and sample quality.

  • Experimental setup: The attacks are evaluated against prior white- and black-box membership inference attacks on generative models trained on MNIST, Fashion-MNIST, and CIFAR-10.The experiments cover both GANs and VAEs.
  • Baselines: The white-box baseline requires discriminator access and applies only to GANs, whereas the black-box baseline trains an auxiliary GAN and needs no target discriminator access.The white-box attack performed significantly better than the black-box attack in the cited prior work.
  • Results: The Monte Carlo attacks outperform the prior white-box attack on MNIST and Fashion-MNIST but are dominated on CIFAR-10.The paper attributes the CIFAR-10 result to poor sample quality, which matters when only very close samples are considered.
  • Additional analyses: Additional experiments vary parameters, regularization, and training-data sizes, while subset analyses examine whether the selected MNIST subset affects attack performance.The MNIST subset study reports no significant influence of subset choice on attack results.

4.2 Attack Parameters

The study examines how MC and Reconstruction attack parameters affect membership-inference accuracy, identifying heuristic and sample-size choices used in later experiments.

  • Parameter analysis: The analysis varies ε and Monte Carlo or reconstruction sample sizes to measure their effects on attack accuracy.MC parameter analysis is restricted to VAEs, while reconstruction-error estimation sample size is studied separately.
  • MC heuristic: The median heuristic outperforms the percentile heuristic, while MC-ε and MC-d perform equivalently under the median heuristic.The median heuristic also avoids requiring a percentile parameter.
  • MC sample size: Higher percentile values require fewer samples to reach their optima, but their accuracy is inferior to the median heuristic.The 10% percentile reaches its optimum at 3,000 samples, whereas the 1% percentile saturates at 10^4 samples.
  • Reconstruction sample size: Reconstruction attacks achieved good preliminary accuracies with n = 300, but later experiments used n = 10^6 for MNIST and Fashion-MNIST and n = 10^5 for CIFAR.The CIFAR setting already achieved approximately 100% single and set membership-inference accuracy.

4.3 Results on MNIST

On MNIST, the proposed attacks outperform prior black-box and white-box attacks, with set membership inference substantially stronger than single-record inference and VAEs more vulnerable than GANs.

  • Architecture comparison: All attacks are more successful against VAEs than GANs, suggesting less overfitting in GANs.The authors relate this observation to independent Annealed Importance Sampling measurements.
  • Comparison with prior attacks: The black-box and white-box attacks do not significantly outperform the 50% random-guessing baseline, whereas the MC attack clearly outperforms them.The comparison uses ten 10% MNIST training subsets and repeated single and set membership-inference experiments.
  • MC attack: Nearly 100% set membership-inference accuracy is achieved against a VAE with PCA distance, compared with about 75% against a GAN.The MC attack is substantially more effective for set inference than for single-record inference.
  • Reconstruction attack: The Reconstruction attack reaches approximately 70% single and 100% set membership-inference accuracy against VAEs.This specialized VAE attack outperforms the MC attack in the reported VAE experiment.

4.4 Effect of Subset Choice

Attack accuracy is largely insensitive to which MNIST subset is selected but declines as training data increases; dropout reduces MC accuracy while Reconstruction remains more robust.

  • Subset choice: MC attack performance appears independent of the specific MNIST training subset, with an F-test yielding p-value ≈0.64 for four VAE accuracy means.The authors conclude that accuracy depends on training-data size rather than the specific records.
  • Regulatory use: Set membership inference can identify a suspected dataset even when additional training data were also used, without requiring the regulator to know all training records.The experiments compare 100 samples from the suspected subset with 100 samples from the remaining training data.
  • Training-data size: Using 40% instead of 10% of MNIST training data reduces MC accuracy from 60% to 51% for single MI and from nearly 100% to about 58% for set MI.The effect is less significant at 20%, and the authors expect more training data to reduce attack effectiveness further.
  • Training-data size: With 40% training data, Reconstruction set accuracy remains about 100%, making it more robust than the MC attack.The reported decline with additional training data suggests generative models use the extra information.
  • Dropout regularization: Reducing dropout keep probability to 70% and 50% lowers MC set accuracy to 79% and 65%, while Reconstruction still reaches approximately 86% at 50%.The experiments use a standard 90% keep probability as the reference setting.

4.6 Results on Fashion MNIST

On Fashion-MNIST, attacks remain more successful against VAEs than GANs, and the Reconstruction attack substantially outperforms competing attacks against VAEs.

  • Architecture comparison: The GAN produces more detailed samples than the VAE, despite attacks being more successful against VAEs.The results therefore pair greater visual detail with lower observed attack success for GANs in this comparison.
  • GAN results: The MC attack achieves about 70% set membership-inference accuracy against GANs, exceeding the white-box attack’s approximately 60%.MC performance is slightly worse on Fashion-MNIST than on MNIST.
  • VAE results: Against VAEs, the Reconstruction attack reaches approximately 57% single and 99% set membership-inference accuracy.It significantly outperforms the other evaluated attacks in both membership-inference settings.

4.7 Results on CIFAR-10

On CIFAR-10, attack effectiveness depends strongly on the distance metric and sample quality. The white-box attack can outperform MC for GANs, while VAEs show strong reconstruction-attack performance.

  • Sample quality: Poorly trained models produced blurry CIFAR-10 samples in which real objects were not identifiable.This sample quality was expected to reduce MC effectiveness because MC relies on samples close to training data.
  • MC attack: The MC attack with CHIST distance was not significantly better than random guessing.Using PCA-based distance instead increased accuracy to roughly 51% and 52% for single MI against GAN and VAE, respectively.
  • MC attack: PCA-based MC reached 65% and 73% set MI accuracy against the GAN and VAE, respectively.The corresponding single MI accuracies were roughly 51% and 52%.
  • Attack comparison: The white-box attack outperformed MC for the GAN trained on CIFAR-10, most likely because of the generator's bad sample quality.The CIFAR-10 comparison used 40 experiments, which were sufficient for significant results.
  • Attack comparison: The white-box attack achieved nearly 100% accuracy for both single-record and set MI, indicating that the discriminator effectively remembered training data.The reconstruction attack showed similar accuracy for the VAE and constantly outperformed the other attacks in that setting.

5 Related Work

The paper situates its attacks within data-leakage research, distinguishing passive membership inference from active attacks and extending generative-model evaluation toward set-level analysis.

  • Threat model: Unlike adversarial examples and adversarial training, this work studies an honest-but-curious adversary accessing a trained model or its generated samples.The adversary infers knowledge about training records rather than actively influencing learning or inference.
  • Membership inference: Membership inference identifies data used to train a model, whereas model inversion attacks try to reconstruct training data from black-box outputs.The paper focuses on membership inference for generative models and compares against prior white-box and black-box attacks.
  • Set membership inference: Set membership inference evaluates a fixed discriminating function over two sample sets to amplify subtle differences and compensate for outliers.The two sets contain samples from training and test data, respectively.
  • Generative-model evaluation: The MC attack differs from KDE by considering only generated samples very close to training records.The paper frames this as a generalization of prior approaches for evaluating generative models.
  • Overfitting: The paper empirically observes that overfitting increased the accuracy of all examined attacks on generative models.This aligns with the reported effect for Hayes et al.'s white-box attack.
  • Distance metrics: For image distances, the paper uses HOG, color histograms, and PCA; preliminary SIFT experiments yielded lower accuracies and were less computationally efficient.SIFT was therefore excluded from the evaluation section.

6 Conclusion

The paper introduces general and VAE-specific membership inference attacks that often outperform prior methods. Its conclusion emphasizes stronger VAE vulnerability and a conditional advantage for GANs.

  • Contributions: The MC attack applies to all generative models, whereas the Reconstruction attack is specialized for VAEs.Both attacks significantly outperform state-of-the-art attacks, often reaching accuracies close to 100%.
  • Results: The Reconstruction attack against VAEs outperformed all other attacks on every dataset.For CIFAR-10, both single and set MI reached approximately 100%.
  • Robustness: The reported attack accuracies remained robust with dropout or more training data.
  • Scope of effectiveness: The MC attack outperformed state of the art on datasets with very good sample quality.On a dataset with very poor sample quality, the white-box attack outperformed the proposed approaches because MC relies on replicated training-data characteristics.
  • Model comparison: VAEs were more vulnerable to membership inference attacks than GANs in the reported experiments.The paper therefore motivates using GANs when they produce detailed samples while being less vulnerable to information leakage.

Appendix: Additional Figures

The appendix presents generated samples from GANs and VAEs trained on MNIST, Fashion-MNIST, and CIFAR-10, including VAE variants with different keep probabilities.

  • MNIST: The appendix includes a GAN trained on MNIST after 500 epochs and a VAE trained on MNIST after 300 epochs.
  • VAE variants: It includes VAE samples with 90% and 50% keep probability.
  • Generated samples: Figures 6 and 7 show generated samples of the trained models.
  • Fashion-MNIST: The appendix includes GAN samples generated after training on Fashion-MNIST.
  • CIFAR-10: Figure 8 shows generated images from a GAN and a VAE trained on CIFAR-10.
Loading 1906.03006v1…