Quantifying Anonymity in Score-Based Generators with Adversarial Fingerprinting

Mischa Dombrowski, Bernhard Kainz

Primary Area: generative models

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Keywords: Quantifying Anonymity in Score-Based Generators with Adversarial Fingerprinting

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2024/AuthorGuide.

TL;DR: Description of privacy breeching in generative models and derivation and experimentation of an indicator to estimate the likelihood of this happening

Abstract:

Recent advances in score-based generative models have led to a huge spike in the development of downstream applications using generative models ranging from data augmentation over image and video generation to anomaly detection.
Despite publicly available trained models, their potential to be used for privacy preserving data sharing has not been fully explored yet.
Training diffusion models on private data and disseminating the models and weights rather than the raw dataset paves the way for innovative large-scale data-sharing strategies, particularly in healthcare, where safeguarding patients' personal health information is paramount.
However, publishing such models without individual consent of, e.g., the patients from whom the data was acquired, necessitates guarantees that identifiable training samples will never be reproduced, thus protecting personal health data and satisfying the requirements of policymakers and regulatory bodies.
This paper introduces a method for estimating the upper bound of the probability of reproducing identifiable training images during the sampling process. This is achieved by designing an adversarial approach that searches for anatomic fingerprints, such as medical devices or dermal art, which could potentially be used to uniquely re-identify training images.
Our method harnesses the learned score-based model to estimate the probability of the entire subspace of the score function that may be utilized for one-to-one reproduction of training samples. To validate our estimates, we generate images containing a fingerprint and investigate whether generated samples from trained generative models can be uniquely mapped to the original training samples.
Overall our results show that privacy-breaching images can be reproduced at sampling time if the models were trained without care.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors' identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 4819