{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/deep-models-under-the-gan-information-leakage","title":"Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning","arxiv_id":"1702.07464","date":"2017-02-24","proceeding":null,"authors":["Briland Hitaj","Giuseppe Ateniese","Fernando Perez-Cruz"],"abstract":"Deep Learning has recently become hugely popular in machine learning,\nproviding significant improvements in classification accuracy in the presence\nof highly-structured and large databases.\n  Researchers have also considered privacy implications of deep learning.\nModels are typically trained in a centralized manner with all the data being\nprocessed by the same training algorithm. If the data is a collection of users'\nprivate data, including habits, personal pictures, geographical positions,\ninterests, and more, the centralized server will have access to sensitive\ninformation that could potentially be mishandled. To tackle this problem,\ncollaborative deep learning models have recently been proposed where parties\nlocally train their deep learning structures and only share a subset of the\nparameters in the attempt to keep their respective training sets private.\nParameters can also be obfuscated via differential privacy (DP) to make\ninformation extraction even more challenging, as proposed by Shokri and\nShmatikov at CCS'15.\n  Unfortunately, we show that any privacy-preserving collaborative deep\nlearning is susceptible to a powerful attack that we devise in this paper. In\nparticular, we show that a distributed, federated, or decentralized deep\nlearning approach is fundamentally broken and does not protect the training\nsets of honest participants. The attack we developed exploits the real-time\nnature of the learning process that allows the adversary to train a Generative\nAdversarial Network (GAN) that generates prototypical samples of the targeted\ntraining set that was meant to be private (the samples generated by the GAN are\nintended to come from the same distribution as the training data).\nInterestingly, we show that record-level DP applied to the shared parameters of\nthe model, as suggested in previous work, is ineffective (i.e., record-level DP\nis not designed to address our attack).","url_abs":"http://arxiv.org/abs/1702.07464v3","url_pdf":"http://arxiv.org/pdf/1702.07464v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"deep-models-under-the-gan-information-leakage","repo_url":"https://github.com/Jaskiee/GAN-Attack-against-Federated-Deep-Learning","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"deep-learning","task_name":"Deep Learning"},{"task_slug":"federated-learning","task_name":"Federated Learning"},{"task_slug":null,"task_name":"Generative Adversarial Network"},{"task_slug":"privacy-preserving","task_name":"Privacy Preserving"}],"methods":[{"method_slug":"convolution","method_name":"Convolution"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1702.07464","atlas_url":"https://app.syntology.ai/?focus=1702.07464","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}