Unveiling Synthetic Faces: How Synthetic Datasets Can Expose Real Identities (2410.24015v1)

Abstract: Synthetic data generation is gaining increasing popularity in different computer vision applications. Existing state-of-the-art face recognition models are trained using large-scale face datasets, which are crawled from the Internet and raise privacy and ethical concerns. To address such concerns, several works have proposed generating synthetic face datasets to train face recognition models. However, these methods depend on generative models, which are trained on real face images. In this work, we design a simple yet effective membership inference attack to systematically study if any of the existing synthetic face recognition datasets leak any information from the real data used to train the generator model. We provide an extensive study on 6 state-of-the-art synthetic face recognition datasets, and show that in all these synthetic datasets, several samples from the original real dataset are leaked. To our knowledge, this paper is the first work which shows the leakage from training data of generator models into the generated synthetic face recognition datasets. Our study demonstrates privacy pitfalls in synthetic face recognition datasets and paves the way for future studies on generating responsible synthetic face datasets.

• The paper designs and implements a membership inference attack that reveals leaked real identities in synthetic face datasets.
• It evaluates six synthetic datasets generated by GANs and diffusion models using cosine similarity of face embeddings.
• The study underscores the need for privacy-preserving mechanisms and automated leakage evaluations in synthetic data generation.

Membership Inference Attack on Synthetic Face Datasets

The paper "Unveiling Synthetic Faces: How Synthetic Datasets Can Expose Real Identities," authored by Hatef Otroshi Shahreza and Sebastien Marcel, addresses a critical privacy concern within computer vision - the potential for synthetic face datasets to leak information from their real training data. The authors provide a systematic paper, evaluating six state-of-the-art synthetic face recognition datasets generated by different deep generative models, namely GANs and Diffusion Models, for potential data leakage.

The primary focus of the research highlights the increasing reliance on synthetic data for training face recognition models. Generative models, such as GANs and diffusion models, are utilized to create these synthetic datasets. A key concern raised is whether these datasets inadvertently preserve identifiable information from the authentic datasets used to train the generative models.

An insightful contribution of this paper is the design and application of a membership inference attack to identify leaked real identities within synthetic datasets. This attack compares every possible pair of images from the synthetic dataset and the original training dataset using a state-of-the-art face recognition model. For similarity assessment, the cosine similarity between face embeddings extracted from these images is examined. The authors effectively demonstrate the presence of real-image leakage in all of the evaluated synthetic datasets, suggesting risks associated with identity exposure.

The implications of this research are considerable for both dataset creators and users in AI. It underscores the necessity for privacy-preserving mechanisms in the creation of synthetic data, particularly when using them in highly sensitive domains like biometrics. The memorization and unintentional data leakage by generative models potentially compromise user privacy, a significant concern amidst increasingly stringent data protection regulations globally.

Future development avenues branch out from this work, highlighting several opportunities and obstacles in the field:

1. Efficient Membership Inference Attacks: Developing more efficient and less computationally intensive strategies for membership inference attacks to handle larger datasets without exhaustive searches could benefit the field significantly.
2. Reduction of Human Bias in Evaluations: The paper points out the necessity of visual evaluations for confirming data leakage, which introduces human bias. Automated and consistent evaluation methods are needed for benchmarking dataset leakage comprehensively.
3. Mitigation Strategies: There is a heightened need for designing synthetic dataset generation methods that inherently mitigate privacy risk, possibly through improved data sanitization techniques or innovative loss functions that reduce memorization of individual identities.
4. Quantification of Leakage: Proposing quantitative metrics to robustly measure and benchmark information leakage levels in synthetic datasets remains an open challenge. Such metrics would provide a standardized method for dataset evaluation and enhance the reliability of synthetic datasets' privacy claims.

The research presented in this paper is a fundamental step towards ensuring the responsible utilization of synthetic datasets in the industry. It opens up a pathway towards more secure data practices, inviting further studies to refine the identified methods, understand their implications deeply, and foster a community-wide movement towards privacy-aware synthetic data utilization.