mlsanityData to 7 Oct 2026

Property Inference Attacks Against GANs

arXiv 2111.07608 ↗First posted 15 Nov 2021cs.CR cs.AI cs.LGcited by 32

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

While machine learning (ML) has made tremendous progress during the past decade, recent research has shown that ML models are vulnerable to various security and privacy attacks. So far, most of the attacks in this field focus on discriminative models, represented by classifiers. Meanwhile, little attention has been paid to the security and privacy risks of generative models, such as generative adversarial networks (GANs). In this paper, we propose the first set of training dataset property inference attacks against GANs. Concretely, the adversary aims to infer the macro-level training dataset property, i.e., the proportion of samples used to train a target GAN with respect to a certain attribute. A successful property inference attack can allow the adversary to gain extra knowledge of the target GAN's training dataset, thereby directly violating the intellectual property of the target model owner. Also, it can be used as a fairness auditor to check whether the target GAN is trained with a biased dataset. Besides, property inference can serve as a building block for other advanced attacks, such as membership inference. We propose a general attack pipeline that can be tailored to two attack scenarios, including the full black-box setting and partial black-box setting. For the latter, we introduce a novel optimization framework to increase the attack efficacy. Extensive experiments over four representative GAN models on five property inference tasks show that our attacks achieve strong performance. In addition, we show that our attacks can be used to enhance the performance of membership inference against GANs.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 42 of its 72 references that are in the map. First posted on arXiv 15 Nov 2021.

Builds on

42 of 72 references.

Closest ancestors · 3

Same direction, newest first

  1. 2021Membership Inference Attacks Against Recommender Systems16 Sep
  2. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning25 Aug
  3. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models4 Feb

Other references · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,530
  4. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  5. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  6. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  7. 2017Improved Training of Wasserstein GANscited by 2,223
  8. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  9. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
  10. 2016WaveNet: A Generative Model for Raw Audiocited by 1,710
  11. 2017High-Resolution Image Synthesis and Semantic Manipulation with Conditional GANscited by 1,176
  12. 2016Practical Black-Box Attacks against Machine Learningcited by 893
27 more
  1. 2014Show and Tell: A Neural Image Caption Generatorcited by 877
  2. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  3. 2013Speech Recognition with Deep Recurrent Neural Networkscited by 666
  4. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  5. 2017Unsupervised Image-to-Image Translation Networkscited by 602
  6. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  7. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  8. 2020Label-Only Membership Inference Attackscited by 371
  9. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  10. 2017EMNIST: an extension of MNIST to handwritten letterscited by 212
  11. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  12. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  13. 2020When Machine Unlearning Jeopardizes Privacycited by 181
  14. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  15. 2017Generalization and Equilibrium in Generative Adversarial Nets (GANs)cited by 165
  16. 2020Membership Leakage in Label-Only Exposurescited by 156
  17. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  18. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 117
  19. 2018Stealing Hyperparameters in Machine Learningcited by 115
  20. 2020Stealing Links from Graph Neural Networkscited by 114
  21. 2016SampleRNN: An Unconditional End-to-End Neural Audio Generation Modelcited by 110
  22. 2018Synthesizing Tabular Data using Generative Adversarial Networkscited by 92
  23. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  24. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 80
  25. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 63
  26. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 35
  27. 2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 8; 2023: 6; 2024: 8; 2025: 4; 2026: 4.

32 papers.

Sort:

By area:

  1. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
  2. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  3. 2022Data Poisoning Attacks Against Multimodal Encoderscited by 41
  4. 2023SoK: Memorization in General-Purpose Large Language Modelscited by 36
  5. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  6. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 26
  7. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Modelscited by 22
  8. 2022Group Property Inference Attacks Against Graph Neural Networkscited by 21
  9. 2022Distribution inference risks: Identifying and mitigating sources of leakagecited by 17
  10. 2022Dissecting Distribution Inferencecited by 15
  11. 2024Inf2Guard: An Information-Theoretic Framework for Learning Privacy-Preserving Representations against Inference Attackscited by 13
  12. 2024Data Mixture Inference: What do BPE Tokenizers Reveal about their Training Data?cited by 13
20 more
  1. 2021Correlation inference attacks against machine learning modelscited by 7
  2. 2024Exploring Privacy and Fairness Risks in Sharing Diffusion Models: An Adversarial Perspectivecited by 6
  3. 2023Attesting Distributional Properties of Training Data for Machine Learningcited by 5
  4. 2023PriSampler: Mitigating Property Inference of Diffusion Modelscited by 4
  5. 2025Can We Infer Confidential Properties of Training Data from LLMs?cited by 4
  6. 2023Adversarial Robustness in Unsupervised Machine Learning: A Systematic Reviewcited by 3
  7. 2024Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approachcited by 3
  8. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  9. 2025Quantifying the Privacy Implications of High-Fidelity Synthetic Network Trafficcited by 3
  10. 2023Class Attribute Inference Attacks: Inferring Sensitive Class Information by Diffusion-Based Attribute Manipulationscited by 2
  11. 2024Inference Attacks: A Taxonomy, Survey, and Promising Directionscited by 2
  12. 2022Inferring Class Label Distribution of Training Data from Classifiers: An Accuracy-Augmented Meta-Classifier Attackcited by 1
  13. 2026Alignment Defends LLMs from Property Inference Attackscited by 1
  14. 2021HyObscure: Hybrid Obscuring for Privacy-Preserving Data Publishingcited by 0
  15. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  16. 2024FRIDA: Free-Rider Detection using Privacy Attackscited by 0
  17. 2025Black-Box Privacy Attacks on Shared Representations in Multitask Learningcited by 0
  18. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  19. 2026Code-Poisoning Property Inference Attackscited by 0
  20. 2026QuanText: Protecting Dataset-Level Secrets in Textual Data Sharingcited by 0