[Paper Review] Generative Model: Membership Attack,Generalization and Diversity

Kin Sum Liu, Bo Li+1 more|arXiv (Cornell University)|May 24, 2018

Adversarial Robustness in Machine Learning13 references18 citations

TL;DR

This paper introduces co-membership attacks, a novel method to determine whether a group of n instances was part of the training data for deep generative models like VAEs and GANs. By optimizing an attacker network to reconstruct input instances and measuring reconstruction error, the method outperforms prior attacks, with VAEs showing higher vulnerability than GANs.

ABSTRACT

In this paper we propose a new membership attack method called co-membership attacks against deep generative models including Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs). Specifically, membership attack aims to check whether a given instance x was used in the training data or not. A co-membership attack checks whether the given bundle of n instances were in the training, with the prior knowledge that the bundle was either entirely used in the training or none at all. Successful membership attacks can compromise the privacy of training data when the generative model is published. Our main idea is to cast membership inference of target data x as the optimization of another neural network (called the attacker network) to search for the latent encoding to reproduce x. The final reconstruction error is used directly to conclude whether x was in the training data or not. We conduct extensive experiments on a variety of datasets and generative models showing that: our attacker network outperforms prior membership attacks; co-membership attacks can be substantially more powerful than single attacks; and VAEs are more susceptible to membership attacks compared to GANs.

Motivation & Objective

• To address the privacy risk posed by membership inference attacks on deep generative models after public release.
• To improve upon existing membership attack methods by leveraging group-level information through co-membership queries.
• To investigate the generalization and privacy trade-offs in VAEs and GANs under membership inference.
• To evaluate the effectiveness of reconstruction-based attacks using latent space optimization.

Proposed method

• Formulate membership inference as an optimization problem where an attacker network learns to reconstruct input instances from latent codes.
• Use reconstruction error from the attacker network as the decision metric to infer membership in the training set.
• Introduce co-membership attacks that assess whether a bundle of n instances was fully in the training data or not, leveraging prior knowledge of bundle-level membership.
• Train the attacker network end-to-end to minimize reconstruction loss for target instances, using the same architecture as the target generative model.
• Apply the method to both VAEs and GANs across multiple datasets to evaluate performance and generalization.
• Compare the attack success rate using reconstruction error thresholds derived from validation data.

Experimental results

Research questions

• RQ1 Can co-membership attacks significantly improve membership inference accuracy compared to single-instance attacks?
• RQ2 How does the reconstruction error of an attacker network correlate with actual training set membership?
• RQ3 Are VAEs more vulnerable to membership attacks than GANs due to their generative mechanism?
• RQ4 To what extent does the group-level structure of data improve attack performance?

Key findings

• The proposed co-membership attack method achieves higher membership inference accuracy than prior single-instance attacks on both VAEs and GANs.
• Co-membership attacks significantly outperform single-instance attacks, especially when the bundle size is moderate to large.
• VAEs are more susceptible to membership attacks than GANs, as evidenced by lower reconstruction errors for training samples.
• The reconstruction error from the attacker network serves as a reliable indicator of membership, with clear separation between training and non-training instances.