[Paper Review] Property Inference Attacks Against GANs

Junhao Zhou, Yufei Chen+2 more|arXiv (Cornell University)|Nov 15, 2021

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper presents the first property inference attacks against GANs, enabling adversaries to infer macro-level training dataset properties—such as demographic proportions—using only generated samples. The attack achieves high accuracy in both full and partial black-box settings, with a novel optimization framework reducing query costs in the latter.

ABSTRACT

While machine learning (ML) has made tremendous progress during the past decade, recent research has shown that ML models are vulnerable to various security and privacy attacks. So far, most of the attacks in this field focus on discriminative models, represented by classifiers. Meanwhile, little attention has been paid to the security and privacy risks of generative models, such as generative adversarial networks (GANs). In this paper, we propose the first set of training dataset property inference attacks against GANs. Concretely, the adversary aims to infer the macro-level training dataset property, i.e., the proportion of samples used to train a target GAN with respect to a certain attribute. A successful property inference attack can allow the adversary to gain extra knowledge of the target GAN's training dataset, thereby directly violating the intellectual property of the target model owner. Also, it can be used as a fairness auditor to check whether the target GAN is trained with a biased dataset. Besides, property inference can serve as a building block for other advanced attacks, such as membership inference. We propose a general attack pipeline that can be tailored to two attack scenarios, including the full black-box setting and partial black-box setting. For the latter, we introduce a novel optimization framework to increase the attack efficacy. Extensive experiments over four representative GAN models on five property inference tasks show that our attacks achieve strong performance. In addition, we show that our attacks can be used to enhance the performance of membership inference against GANs.

Motivation & Objective

• Address the lack of privacy and security analysis for generative models, particularly GANs, beyond membership inference.
• Investigate whether an adversary can infer macro-level properties of a GAN’s training dataset without access to model parameters or training data.
• Develop a generalizable attack pipeline effective in both full black-box and partial black-box settings.
• Demonstrate that property inference can serve as a building block for more advanced attacks, such as membership inference.
• Provide a fairness auditing mechanism to detect biased training data in GANs.

Proposed method

• Propose a general attack pipeline: query the target GAN to obtain generated samples, then use a property classifier to label samples based on the target attribute (e.g., gender, skin tone).
• In the full black-box setting, use randomly sampled latent codes to generate diverse samples for property classification.
• In the partial black-box setting, introduce a novel optimization framework to generate an optimized latent code set that maximizes information gain per query.
• Leverage shadow models to guide the optimization of latent codes, improving attack efficiency and reducing query count.
• Model the property inference task as a regression problem to predict continuous proportions (e.g., 30% white females), not just binary classification.
• Use the predicted property to infer global dataset characteristics, such as demographic distribution or data bias.

Experimental results

Research questions

• RQ1 Can an adversary infer macro-level properties of a GAN’s training dataset using only generated samples and no access to model parameters or training data?
• RQ2 How effective is property inference in the full black-box setting where only random sampling is allowed?
• RQ3 Can an optimized latent code generation framework improve attack performance in the partial black-box setting with limited queries?
• RQ4 To what extent can property inference enhance membership inference attacks against GANs?
• RQ5 Can property inference serve as a fairness auditing tool to detect biased training data in GANs?

Key findings

• The proposed property inference attacks achieve high accuracy in inferring training dataset properties such as gender and skin tone distributions across multiple GAN models and datasets.
• In the gender prediction task on CelebA, the attack achieves an average absolute error of less than 0.05 in estimating the proportion of white females in the training set.
• The partial black-box attack with optimized latent codes significantly reduces the number of queries required to achieve comparable or better performance than random sampling.
• The attack demonstrates strong stability and accuracy even with limited query budgets, outperforming baseline methods in both full and partial black-box settings.
• Property inference results can be leveraged to improve membership inference attacks, indicating its potential as a foundational technique for advanced privacy attacks.
• The method successfully detects biased training data distributions, validating its utility as a fairness auditing tool for GANs.