Generative Adversarial Network

How a GAN learns

A GAN learns from a contest of two networks, a “minimax two-player game” in the words of Goodfellow and colleagues. Each training cycle has these steps:

1. The generator changes random noise into a batch of fake samples.
2. The discriminator gets the fake samples and real samples from the training data.
3. The discriminator gives each sample a probability that it is real, and learns to be correct.
4. The generator learns to make the discriminator give an incorrect answer.

At the ideal end point, the generator makes samples like the real data. The discriminator then gives each sample 1/2, a pure guess.

Why GANs matter for security

Research shows four security uses of GANs:

Use	Source and date	Result
Deepfake faces	UK CDEI, Sep 2019	GANs make “entirely new images of faces”
Password guesses	PassGAN, Hitaj et al., Sep 2017	With HashCat, 51% to 73% more passwords matched than HashCat alone
Privacy attack	LOGAN, Hayes et al., May 2017	First membership inference attacks against generative models
Detection	Wang et al., Dec 2019	A detector that learned from ProGAN images only also found images of unseen generators

Defence has limits. The LOGAN authors found that the defences they tested were “either ineffective” or made the models much worse. The title of the paper by Wang and colleagues says GAN images are easy to spot “for now”. For current tools, see deepfake detection.

GAN vs diffusion model

In May 2021, Dhariwal and Nichol showed that a diffusion model can get a better image score than BigGAN-deep. They compared FID on ImageNet, where a lower score is better:

Resolution	Guided diffusion	BigGAN-deep
128 x 128	2.97	6.02
256 x 256	4.59	6.95
512 x 512	7.72	8.43

The trade offs, from the same paper and from the 2016 tutorial by Goodfellow:

• Speed. A GAN can make samples in parallel. Diffusion models are “still slower than GANs at sampling time” because of many denoising steps.
• Diversity. GANs capture less diversity than likelihood based models.
• Stable training. GANs are “often difficult to train, collapsing without carefully selected hyperparameters and regularizers”.

The first GAN paper of 2014 used small image sets. In 2018, StyleGAN from NVIDIA used 70,000 Flickr face photos at 1024 x 1024 pixels.

Why GANs are hard to train

The first paper and the 2016 tutorial name two problems:

• Mode collapse. The generator maps many different noise inputs to the same output. The 2014 paper called this “the Helvetica scenario”.
• No convergence. Training must find a balance point of a game, not the minimum of one score. Goodfellow writes that the two networks can “repeatedly undo each others’ progress without arriving anywhere useful”.

The 2014 paper also says that the discriminator “must be synchronized well with” the generator. If not, the generator can map too many noise inputs to one output.

Questions and answers

Who invented the generative adversarial network?

Ian Goodfellow, Yoshua Bengio and six other authors published the first GAN paper on arXiv on 10 June 2014. Their tests used three small image sets: MNIST, the Toronto Face Database and CIFAR-10.

Are GANs still used, or did diffusion models replace them?

In May 2021, Dhariwal and Nichol reported a better FID than BigGAN-deep on ImageNet at three resolutions. But they also wrote that diffusion models are "still slower than GANs at sampling time", because of multiple denoising steps.

How is a GAN different from an adversarial example?

An adversarial example is an input that an attacker changes to make a model give an incorrect answer. A GAN is a training method. In a GAN, the word "adversarial" means that two networks of the same system compete. The two networks do not attack a third party.