mlsanityData to 7 Oct 2026

On the Privacy Properties of GAN-generated Samples

arXiv 2206.01349 ↗First posted 3 Jun 2022cs.LG cs.AI cs.CRcited by 16

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

The privacy implications of generative adversarial networks (GANs) are a topic of great interest, leading to several recent algorithms for training GANs with privacy guarantees. By drawing connections to the generalization properties of GANs, we prove that under some assumptions, GAN-generated samples inherently satisfy some (weak) privacy guarantees. First, we show that if a GAN is trained on m samples and used to generate n samples, the generated samples are (epsilon, delta)-differentially-private for (epsilon, delta) pairs where delta scales as O(n/m). We show that under some special conditions, this upper bound is tight. Next, we study the robustness of GAN-generated samples to membership inference attacks. We model membership inference as a hypothesis test in which the adversary must determine whether a given sample was drawn from the training dataset or from the underlying data distribution. We show that this adversary can achieve an area under the ROC curve that scales no better than O(m^{-1/4}).

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 34 of its 49 references that are in the map. First posted on arXiv 3 Jun 2022.

Builds on

34 of 49 references.

References · 34

  1. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  2. 2016Deep Learning with Differential Privacycited by 2,682
  3. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  4. 2017Improved Training of Wasserstein GANscited by 2,223
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2016Density estimation using Real NVPcited by 2,029
  7. 2018Spectral Normalization for Generative Adversarial Networkscited by 1,618
  8. 2016Pixel Recurrent Neural Networkscited by 814
  9. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  10. 2016f-GAN: Training Generative Neural Samplers using Variational Divergence Minimizationcited by 504
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  12. 2017Towards Principled Methods for Training Generative Adversarial Networkscited by 460
22 more
  1. 2018Invertible Residual Networkscited by 364
  2. 2017Real-valued (Medical) Time Series Generation with Recurrent Conditional GANscited by 329
  3. 2013The Composition Theorem for Differential Privacycited by 290
  4. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  5. 2018Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergencescited by 237
  6. 2017Generating Multi-label Discrete Patient Records using Generative Adversarial Networkscited by 197
  7. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  8. 2020GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generatorscited by 117
  9. 2017PacGAN: The power of two samples in generative adversarial networkscited by 104
  10. 2014Preserving Statistical Validity in Adaptive Data Analysiscited by 102
  11. 2015Algorithmic Stability for Adaptive Data Analysiscited by 88
  12. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 83
  13. 2017On the Discrimination-Generalization Tradeoff in GANscited by 48
  14. 2019Detecting Overfitting of Deep Generative Networks via Latent Recoverycited by 44
  15. 2018Approximability of Discriminators Implies Diversity in GANscited by 28
  16. 2020Why Spectral Normalization Stabilizes GANs: Analysis and Improvementscited by 21
  17. 2019Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protectioncited by 19
  18. 2015Learning with Differential Privacy: Stability, Learnability and the Sufficiency and Necessity of ERM Principlecited by 16
  19. 2016Adaptive Learning with Robust Generalization Guaranteescited by 15
  20. 2020Modelling and Quantifying Membership Information Leakage in Machine Learningcited by 11
  21. 2019GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Modelscited by 10
  22. 2015On the Generalization Properties of Differential Privacycited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 5; 2024: 2; 2025: 5; 2026: 1.

16 papers.

Sort:

By area:

  1. 2023Differentially Private Synthetic Data via Foundation Model APIs 1: Imagescited by 63
  2. 2022RelaxLoss: Defending Membership Inference Attacks without Losing Utilitycited by 35
  3. 2024PrE-Text: Training Language Models on Private Federated Data in the Age of LLMscited by 29
  4. 2023Ten Years of Generative Adversarial Nets (GANs): A survey of the state-of-the-artcited by 14
  5. 2025POPri: Private Federated Learning using Preference-Optimized Synthetic Datacited by 14
  6. 2025DPImageBench: A Unified Benchmark for Differentially Private Image Synthesiscited by 11
  7. 2022Privacy-Preserving Federated Deep Clustering based on GANcited by 5
  8. 2023Adversarial Robustness in Unsupervised Machine Learning: A Systematic Reviewcited by 3
  9. 2024Federated Diffusion Modeling with Differential Privacy for Tabular Data Synthesiscited by 2
  10. 2025A Comprehensive Survey on Network Traffic Synthesis: From Statistical Models to Deep Learningcited by 2
  11. 2022Differentially Private Learning of Hawkes Processescited by 1
  12. 2023On the causality-preservation capabilities of generative modellingcited by 1
4 more
  1. 2023Generative Semi-supervised Learning with Meta-Optimized Synthetic Samplescited by 1
  2. 2025Assessing the Effectiveness of Membership Inference on Generative Musiccited by 1
  3. 2025Privacy Preserving Diffusion Models for Mixed-Type Tabular Data Generationcited by 0
  4. 2026Protecting and Preserving Protest Dynamics for Responsible Analysiscited by 0