Differentially Private Functional Mechanism for Generative Adversarial Networks

Abstract

In recent years, generative adversarial network (GAN) has attracted great attention due to its impressive performance and potential numerous applications, such as data augmentation, real-like image synthesis, image compression improvement, etc. The generator in GAN learns the density of the distribution from real data in order to generate high fidelity fake samples from latent space and deceive the discriminator. Despite its advantages, GAN can easily memorize training samples because of the high model complexity of deep neural networks. Thus, training a GAN with sensitive or private data samples may compromise the privacy of training data. To address this privacy issue, we propose a novel \textit{Privacy Preserving Generative Adversarial Network} (PPGAN) that perturbs the objective function of discriminator by injecting Laplace noises based on functional mechanism to guarantee the differential privacy of training data. Since generator training is considered as a post-processing step while guaranteeing differential privacy of discriminator, the trained generator should be differentially private to effectively protect data samples. Through detailed privacy analysis, we theoretically prove that PPGAN can provide such strict differential privacy guarantee. With extensive simulation study on the benchmark dataset MNIST, we show the efficacy of the proposed PPGAN under practical privacy budgets.