# Preserving Privacy in GANs Against Membership Inference Attack

arXiv: https://arxiv.org/abs/2311.03172 · HTML: https://mlsanity.com/paper/2311.03172/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 25 of its 44 references that are in the map.
- First posted on arXiv 6 Nov 2023.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 25 of 25)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [Large Scale GAN Training for High Fidelity Natural Image Synthesis](https://mlsanity.com/paper/1809.11096/) (2018)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Label-Only Membership Inference Attacks](https://mlsanity.com/paper/2007.14321/) (2020)
- [Differentiable Augmentation for Data-Efficient GAN Training](https://mlsanity.com/paper/2006.10738/) (2020)
- [Systematic Evaluation of Privacy Risks of Machine Learning Models](https://mlsanity.com/paper/2003.10595/) (2020)
- [Differentially Private Generative Adversarial Network](https://mlsanity.com/paper/1802.06739/) (2018)
- [Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference](https://mlsanity.com/paper/1906.11798/) (2019)
- [Reconstruction and Membership Inference Attacks against Generative Models](https://mlsanity.com/paper/1906.03006/) (2019)
- [An empirical study on evaluation metrics of generative adversarial networks](https://mlsanity.com/paper/1806.07755/) (2018)
- [How good is my GAN?](https://mlsanity.com/paper/1807.09499/) (2018)
- [On Memorization in Probabilistic Deep Generative Models](https://mlsanity.com/paper/2106.03216/) (2021)
- [A Non-Parametric Test to Detect Data-Copying in Generative Models](https://mlsanity.com/paper/2004.05675/) (2020)
- [Differentially Private Data Generative Models](https://mlsanity.com/paper/1812.02274/) (2018)
- [Performing Co-Membership Attacks Against Deep Generative Models](https://mlsanity.com/paper/1805.09898/) (2018)
- [Adversarial Attacks Against Deep Generative Models on Data: A Survey](https://mlsanity.com/paper/2112.00247/) (2021)
- [Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection](https://mlsanity.com/paper/1908.07882/) (2019)
- [Privacy-Preserving Adversarial Networks](https://mlsanity.com/paper/1712.07008/) (2017)
- [Empirical Analysis of Overfitting and Mode Drop in GAN Training](https://mlsanity.com/paper/2006.14265/) (2020)
- [The Long Road to Computational Location Privacy: A Survey](https://mlsanity.com/paper/1810.03568/) (2018)
- [GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models](https://mlsanity.com/paper/1909.03935/) (2019)
- [Generating Artificial Data for Private Deep Learning](https://mlsanity.com/paper/1803.03148/) (2018)
- [Real-Time Privacy-Preserving Data Release for Smart Meters](https://mlsanity.com/paper/1906.06427/) (2019)
- [Privacy-Preserving Synthetic Smart Meters Data](https://mlsanity.com/paper/2012.04475/) (2020)

## Built on by (most cited first, 2 of 2)

- [NOVA-3D: Non-overlapped Views for 3D Anime Character Reconstruction](https://mlsanity.com/paper/2405.12505/) (2024)
- [EmbeddGAN: A Novel GAN Framework Using an Embedding Network and Gini Distance Correlation](https://mlsanity.com/paper/2609.22508/) (2026)

## Abstract (arXiv)

Generative Adversarial Networks (GANs) have been widely used for generating synthetic data for cases where there is a limited size real-world dataset or when data holders are unwilling to share their data samples. Recent works showed that GANs, due to overfitting and memorization, might leak information regarding their training data samples. This makes GANs vulnerable to Membership Inference Attacks (MIAs). Several defense strategies have been proposed in the literature to mitigate this privacy issue. Unfortunately, defense strategies based on differential privacy are proven to reduce extensively the quality of the synthetic data points. On the other hand, more recent frameworks such as PrivGAN and PAR-GAN are not suitable for small-size training datasets. In the present work, the overfitting in GANs is studied in terms of the discriminator, and a more general measure of overfitting based on the Bhattacharyya coefficient is defined. Then, inspired by Fano's inequality, our first defense mechanism against MIAs is proposed. This framework, which requires only a simple modification in the loss function of GANs, is referred to as the maximum entropy GAN or MEGAN and significantly improves the robustness of GANs to MIAs. As a second defense strategy, a more heuristic model based on minimizing the information leaked from generated samples about the training data points is presented. This approach is referred to as mutual information minimization GAN (MIMGAN) and uses a variational representation of the mutual information to minimize the information that a synthetic sample might leak about the whole training data set. Applying the proposed frameworks to some commonly used data sets against state-of-the-art MIAs reveals that the proposed methods can reduce the accuracy of the adversaries to the level of random guessing accuracy with a small reduction in the quality of the synthetic data samples.