Pith. sign in

REVIEW 4 major objections 4 minor 40 references

Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A differentially private training algorithm bounds a GAN's generalization gap by a data-independent constant, and membership-attack experiments show that Lipschitz regularization reduces both the gap and information leakage.

desk verdict A useful if modest paper: it repackages known DP-to-generalization results and gives a plausible empirical link between Lipschitz regularization and membership leakage, though the link is weaker than the authors claim because both metrics reuse the discriminator's train/test score gap. read the letter →

arxiv 1908.07882 v3 pith:ID34CTPA submitted 2019-08-21 cs.LG cs.CRstat.ML

Bingzhe Wu , Shiwan Zhao , ChaoChao Chen , Haoyang Xu , Li Wang , Xiaolu Zhang , Guangyu Sun , Jun Zhou This is my paper · ORCID
classification cs.LGcs.CRstat.ML
keywords generalizationgapdifferentialprivacymembershipattackGANLipschitzregularizationuniformRO-stabilityBayesianinformationleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that overfitting in GANs is the same phenomenon as privacy leakage: if the discriminator is trained by an algorithm that satisfies $\epsilon$-differential privacy, then the generalization gap is bounded by $e^\epsilon - 1$, a constant that does not depend on the data. The point matters because it gives a way to reason about GAN generalization without distributional assumptions, and it predicts that stable or Lipschitz-constrained training procedures should both generalize better and leak less about individual training images. To test that prediction, the authors run membership attacks on GANs trained with and without Lipschitz regularizers on a face dataset and a medical-image dataset, and find that the regularizers lower the attack success rate and the generalization gap together. They also reinterpret Bayesian GANs as implicitly privacy-preserving through posterior sampling.

What carries the argument

The load-bearing mechanism is stability-based generalization theory: uniform RO-stability, defined as the worst-case change in expected discriminator output when one training example is replaced, together with the lemma that $\epsilon$-differential privacy implies $(e^\epsilon - 1)$-RO-stability. This converts a privacy guarantee into a bound on the generalization gap, and McDiarmid's inequality turns pointwise stability into a uniform-convergence bound. The empirical instrument is the membership attack, which treats the discriminator output $d(x;\theta_d)/b$ as a score and classifies an image as training or non-training by thresholding it, while the gap between training and testing losses serves as the measured generalization gap.

What would settle it

If a GAN is trained with an $\epsilon$-differentially-private algorithm and the generalization gap is measured empirically on a dataset where the true gap is known, a gap larger than $e^\epsilon - 1$ would contradict Theorem 1; alternatively, if a Lipschitz-regularized model shows a reduction in generalization gap but no reduction in membership-attack success under a black-box attack that does not use the training-set average, the claimed linkage between the two would be called into question.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is Theorem 1: if a randomized training algorithm $A$ for the GAN discriminator satisfies $\epsilon$-differential privacy, then the generalization gap $|F_U(A)|$ is at most $e^\epsilon - 1$, obtained through the chain differential privacy $\Rightarrow$ uniform RO-stability $\Rightarrow$ generalization. Theorem 2 extends this to every iteration of training via a uniform-convergence bound that combines post-processing with McDiarmid's inequality, and the generator inherits the privacy guarantee through post-processing because its loss does not touch the original data. The empirical half of the paper measures information leakage with membership attacks built on the discriminator's bounded output, and the LFW and IDC experiments show that weight clipping, gradient penalty, and spectral normalization all reduce both the generalization gap and the attack's F1 and AUC relative to an unregularized GAN. The paper reads this as validation of the intuition that generalization and privacy are two faces of the same stability property.

Load-bearing premise

The white-box membership attack assumes the attacker has access to the average discriminator output on the training dataset and uses it as the classification threshold, an advantage that standard membership-inference threat models do not grant.

Editorial extensions

If this is right

  • Any GAN whose discriminator is trained by an $\epsilon$-differentially-private mechanism inherits a data-independent upper bound on its generalization gap, so overfitting is controlled by design rather than by model selection.
  • The same guarantee transfers to the generator through post-processing, since the generator's loss never directly touches the original training data.
  • Lipschitz regularization techniques such as weight clipping, gradient penalty, and spectral normalization should reduce membership-inference success whenever they reduce the generalization gap; the paper's experiments on LFW and IDC support this expectation.
  • Bayesian GANs trained by stochastic Hamiltonian Monte Carlo can be seen as approximately differentially private, which offers a privacy-based explanation for their ability to avoid mode collapse.
  • Privacy-preserving training algorithms become a viable design route for GANs on sensitive data, combining regularized training with leakage resistance in one procedure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The white-box attack's threshold assumption means the reported F1 and AUC values are upper bounds on practical leakage; the paper's own black-box results, with much lower AUC, suggest that the transferable privacy comparison should be measured without giving the attacker the training-set average score.
  • If stability is the true mechanism, then other stabilizers—early stopping, dropout, label smoothing, or added noise—should also reduce membership-attack success; testing this would separate the privacy effect from the specific Lipschitz implementation.
  • The theoretical bound applies to the discriminator's objective, not to the quality or realism of generated samples, so privacy and perceptual quality are separable axes that a practitioner could trade off explicitly rather than relying on regularization to do both.
  • A full end-to-end guarantee for alternating GAN training would require composition analysis over the sequence of discriminator and generator updates; the paper marks this as future work, and completing it would turn the single-step bound into a training-wide privacy guarantee.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript proposes to understand generalization in GANs through the lens of differential privacy. It proves (Theorem 1) that an ε-differentially private training algorithm for the discriminator has a generalization gap bounded by e^ε−1, via the stability-based generalization framework. It sketches a uniform-convergence result (Theorem 2), reinterprets Bayesian GANs as implicitly privacy-preserving, and reports membership-attack experiments on LFW and IDC datasets, concluding that Lipschitz regularization reduces both the discriminator's train/test gap and the measured information leakage.

Significance. If the central claims were established, the paper would offer a practically appealing prescription: training GANs with differentially private algorithms, or with Lipschitz regularizers that approximate stability, yields both generalization and privacy benefits. The paper's Theorem 1 is a correct but standard application of known stability-based generalization results (e.g., Wang et al. [35]); its novelty lies mainly in framing GAN training in this way. The empirical study is clearly described, and the use of a clinical dataset and a black-box attack are commendable. However, the value of the contribution rests on the correctness of Theorem 2 and on the independence of the empirical metrics, and both require substantial work before the claims are supported.

major comments (4)
  1. [A.2 (Eq. 10)] The proof of Theorem 2 does not go through as written. McDiarmid's inequality (Lemma 6) requires a pointwise bounded-difference condition on the function φ for every pair of inputs, whereas the uniform RO-stability property (Definition 2 and Lemma 1) bounds a difference of expectations, not pointwise differences. The proof then invokes 'Lemma 4' to derive the probability bound in Eq. (10), but Lemma 4 is an expectation bound, not a concentration inequality, and no argument bridges the two. Moreover, the proof attributes the post-processing property to Lemma 3, which is actually the DP-to-stability lemma. Consequently, Theorem 2 is unproven as stated and should be either proved rigorously or removed.
  2. [4.2, Table 1; 4.1] The central empirical claim is confounded by the use of the same discriminator output as both the generalization-gap indicator and the membership-attack score. The 'Gap' in Table 1 is the difference between training and test discriminator losses, while the white-box attack scores each image by d(x;θ_d) and either thresholds it (F1) or sweeps thresholds (AUC). Any regularizer that reduces the train/test discrepancy of d(x;θ_d) will therefore mechanically lower both metrics, so the observed association does not independently validate a privacy-generalization connection. The black-box attack in Section 4.3 partially addresses this, but it still derives its score from a (fake) discriminator's output, and the generator is never directly attacked. An independent leakage measurement is needed to support the paper's conclusion.
  3. [4.2, Table 1] No variance information is reported. GAN training is stochastic, and many of the differences in Table 1 are small (e.g., LFW Wasserstein spectral normalization F1=0.515 vs. gradient penalty F1=0.492; IDC AUC values 0.508 vs. 0.504). Without multiple seeds, confidence intervals, or error bars, the statistical significance of the reported reductions cannot be assessed, weakening the conclusion that Lipschitz regularization 'effectively' reduces information leakage.
  4. [3, Connection to Bayesian GAN] The claim that stochastic HMC sampling preserves differential privacy 'with minor modification' (referencing Section 4 of [34]) is not supported by any proof or precise algorithmic specification. The paper does not show that the HMC sampler satisfies the assumptions of Wang et al. [34], nor does it state what the modification is. Since the Bayesian GAN reinterpretation is listed as a contribution, this claim should be either proved in detail or explicitly presented as a conjecture.
minor comments (4)
  1. [3] The theorem numbering is inconsistent: the text says 'we introduce Theorem 3 as follows: Theorem 1 (Generalization gap)' and later refers back to 'Theorem 3'. Please renumber the theorems for consistency.
  2. [A.3] Table 3's caption contains the typo 'hype-parameters'; it should be 'hyper-parameters'.
  3. [4.1] The F1 computation assumes the attacker knows the average value of d(x;θ_d) over the entire training set, which is a strong threat-model assumption. The AUC values are threshold-independent and should be emphasized as the primary evidence for leakage.
  4. [4.2] The N/A entries for Gradient Penalty under JS divergence are not explained in the text; please clarify why training collapsed for that configuration.

Circularity Check

2 steps flagged · score 6.0 of 10

The empirical privacy–generalization link is partly tautological: membership leakage and generalization gap are measured from the same discriminator outputs, and the F1 threshold is fitted to the training data.

  1. self definitional [Section 4.1 (Attack setup) and Section 4.2 (Table 1, Gap column)]
    "We build the attack model based on the output of the discriminator... A outputs 1 if d(x;θd)/b≥t ... we use the gap between the testing and training losses to estimate the generalization gap."

    The 'information leakage' score and the 'generalization gap' are computed from the same function d(x;θd): the gap is the train/test difference of the discriminator loss, and the white-box attack is thresholding d(x;θd), with the F1 threshold set to the training average of d. Lipschitz regularization that compresses or stabilizes the discriminator's train/test separation will therefore lower both columns in Table 1 by construction. The observed co-movement is not independent evidence that regularization improves privacy; the privacy metric is defined through the very same train/test signal used to define overfitting.

  2. fitted input called prediction [Section 4.1, Attack setup (F1 score computation)]
    "To compute the F1 score, we assume the attacker has obtained the average value of d(x;θd) on the training dataset. Thus we can set the average value as the threshold t and then compute the F1 score at this threshold."

    The membership-classification threshold is fitted to the training dataset's discriminator outputs—the exact quantity the attack is supposed to infer. Because the threshold is the training mean, any training-specific upward shift of d automatically pushes a large fraction of training examples above threshold, inflating F1. The comparison of F1 across regularizers is therefore partly mechanical, although the AUC column, which does not use this threshold, is less affected.

full rationale

The theoretical core of the paper is not circular: Theorem 1 composes two standard external results (differential privacy implies uniform RO-stability; uniform RO-stability bounds the generalization gap) and does not fit any constants from the data. The Bayesian GAN discussion cites Wang et al. and asserts a 'minor modification' without proof, but that is an unverified bridge rather than a circularity. The self-citation [36] appears only as a domain example and is not load-bearing. The significant circularity is in the empirical validation: the membership attack uses the discriminator output d(x;θd) as its signal, and the generalization gap is also defined as the train/test difference of the discriminator loss. The white-box F1 metric further sets its threshold to the training average of d(x;θd), so the F1 numbers are partly forced by construction. Since the paper's central empirical claim—that Lipschitz regularization reduces both generalization gap and information leakage—rests on this shared statistic, the privacy-generalization link is only partially supported by independent evidence. This warrants a score of 6: partial circularity in the empirical prediction, while the formal theorem remains independent.

Assumptions & free parameters 1 free parameters · 6 assumptions · 0 invented entities

The paper's theoretical conclusions rest entirely on standard stability and DP lemmas, plus an unproven operationalization of the generalization gap and an asserted link from Lipschitz regularization to stability. The Bayesian GAN section introduces a plausible but unverified assumption about HMC sampling and DP. No new physical or mathematical entities are invented.

free parameters (1)
  • membership attack threshold t = average d(x; theta_d) over the training set
    Chosen adaptively from the training data in Section 4.1; this data-derived threshold grants the attacker an extra statistic and inflates apparent leakage.
assumptions (6)
  • standard math Differential privacy implies uniform RO-stability (Lemma 1, from Wang et al. 2016)
    Used at the core of Theorem 1 to convert epsilon-DP into a stability rate.
  • standard math Uniform RO-stability bounds the generalization gap (Lemma 2, from Shalev-Shwartz et al. 2010)
    Second step of Theorem 1.
  • domain assumption Discriminator output is bounded by b, set to 1 for the attack threshold
    Section 4.1: 'Suppose d(x;theta_d)<=b'; standard for sigmoid-output discriminators but restricts the analysis.
  • domain assumption Train-test loss difference estimates the theoretical generalization gap
    Section 4.2 states the gap is estimated by testing-minus-training losses, but no formula is given; the validity of this proxy is assumed.
  • ad hoc to paper Lipschitz regularization leads to stability analogous to DP
    In Section 3 the authors 'infer' Lipschitz constraints imply stability, but no theorem formalizes or proves this connection.
  • ad hoc to paper HMC posterior sampling preserves differential privacy with a minor modification
    Section 3, 'Connection to Bayesian GAN' asserts this based on Wang et al. 2015 without stating the modification or providing a proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection." pith.science (2026). https://pith.science/paper/ID34CTPA

@misc{pith2026190807882,
  author       = {Pith},
  title        = {Pith review of: Generalization in Generative Adversarial Networks: A Novel Perspective from Privacy Protection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ID34CTPA}},
  note         = {Machine review of arXiv:1908.07882}
}
read the original abstract

In this paper, we aim to understand the generalization properties of generative adversarial networks (GANs) from a new perspective of privacy protection. Theoretically, we prove that a differentially private learning algorithm used for training the GAN does not overfit to a certain degree, i.e., the generalization gap can be bounded. Moreover, some recent works, such as the Bayesian GAN, can be re-interpreted based on our theoretical insight from privacy protection. Quantitatively, to evaluate the information leakage of well-trained GAN models, we perform various membership attacks on these models. The results show that previous Lipschitz regularization techniques are effective in not only reducing the generalization gap but also alleviating the information leakage of the training dataset.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 27 canonical work pages

  1. [35]

    Fienberg

    Yu-Xiang Wang, Jing Lei, and Stephen E. Fienberg. Learning with differential privacy: Stability, learnability and the sufficiency and necessity of ERM principle. Journal of Machine Learning Research, 17:183:1–183:40, 2016

    work page 2016

  2. [34]

    Fienberg, and Alexander J

    Yu-Xiang Wang, Stephen E. Fienberg, and Alexander J. Smola. Privacy for free: Posterior sampling and stochastic gradient monte carlo. In Proceedings of the 32nd International Conference on Machine Learning, ICML 2015, Lille, France, 6-11 July 2015, pages 2493–2502, 2015

    work page 2015

  3. [1]

    Wasserstein gan

    Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein gan. arXiv preprint arXiv:1701.07875, 2017

    arXiv 2017

  4. [2]

    Generalization and equilibrium in generative adversarial nets (gans)

    Sanjeev Arora, Rong Ge, Yingyu Liang, Tengyu Ma, and Yi Zhang. Generalization and equilibrium in generative adversarial nets (gans). In Proceedings of the 34th International Conference on Machine Learning, ICML 2017, Sydney, NSW, Australia, 6-11 August 2017 , pages 224–232, 2017

    work page 2017

  5. [3]

    Tenenbaum, William T

    David Bau, Jun-Yan Zhu, Hendrik Strobelt, Bolei Zhou, Joshua B. Tenenbaum, William T. Freeman, and Antonio Torralba. Visualizing and understanding generative adversarial networks. In International Conference on Learning Representations, 2019

    work page 2019

  6. [4]

    Ritchie, and Nick Weston

    Andrew Brock, Theodore Lim, James M. Ritchie, and Nick Weston. Neural photo editing with introspective adversarial networks. In5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings, 2017

    work page 2017

  7. [5]

    The secret sharer: Measuring unintended neural network memorization and extracting secrets

    Nicholas Carlini, Chang Liu, Jernej Kos, Úlfar Erlingsson, and Dawn Song. The secret sharer: Measuring unintended neural network memorization and extracting secrets. ArXiv e-prints, 1802.08232, 2018

    arXiv 2018

  8. [6]

    Cartoongan: Generative adversarial networks for photo cartoonization

    Yang Chen, Yu-Kun Lai, and Yong-Jin Liu. Cartoongan: Generative adversarial networks for photo cartoonization. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pages 9465–9474, 2018

    work page 2018

Show all 40 references
  1. [7]

    Adaptive learning with robust generalization guarantees

    Rachel Cummings, Katrina Ligett, Kobbi Nissim, Aaron Roth, and Zhiwei Steven Wu. Adaptive learning with robust generalization guarantees. In Proceedings of the 29th Conference on Learning Theory, COLT 2016, New York, USA, June 23-26, 2016, pages 772–814, 2016

    2016

  2. [8]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei Li. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA, pages 248–255, 2009

    2009

  3. [9]

    Differential privacy

    Cynthia Dwork. Differential privacy. Encyclopedia of Cryptography and Security , pages 338–340, 2011

    2011

  4. [10]

    The algorithmic foundations of differential privacy

    Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Founda- tions and Trends in Theoretical Computer Science, 9(3-4):211–407, 2014

    2014

  5. [11]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, editors, Advances in Neural Information ...

    2014

  6. [12]

    Courville

    Ishaan Gulrajani, Faruk Ahmed, Martín Arjovsky, Vincent Dumoulin, and Aaron C. Courville. Improved training of wasserstein gans. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, 4-9 December 2017, Long Be...

    2017

  7. [13]

    LOGAN: evalu- ating privacy leakage of generative models using generative adversarial networks

    Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. LOGAN: evalu- ating privacy leakage of generative models using generative adversarial networks. CoRR, abs/1705.07663, 2017

    2017 arXiv

  8. [14]

    Bayesian modelling and monte carlo inference for GAN

    Hao He, Hao Wang, Guang-He Lee, and Yonglong Tian. Bayesian modelling and monte carlo inference for GAN. In International Conference on Learning Representations, 2019. 9

    2019

  9. [15]

    Deep learning for digital pathology image analysis: A comprehensive tutorial with selected use cases

    Andrew Janowczyk and Anant Madabhushi. Deep learning for digital pathology image analysis: A comprehensive tutorial with selected use cases. Journal of pathology informatics, 7, 2016

    2016

  10. [16]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. CoRR, abs/1812.04948, 2018

    2018 arXiv

  11. [17]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015

    2015

  12. [18]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009

    2009

  13. [19]

    Huang Erik Learned-Miller

    Gary B. Huang Erik Learned-Miller. Labeled faces in the wild: Updates and new reporting procedures. Technical Report UM-CS-2014-003, University of Massachusetts, Amherst, May 2014

    2014

  14. [20]

    Aitken, Alykhan Tejani, Johannes Totz, Zehan Wang, and Wenzhe Shi

    Christian Ledig, Lucas Theis, Ferenc Huszar, Jose Caballero, Andrew Cunningham, Alejandro Acosta, Andrew P. Aitken, Alykhan Tejani, Johannes Totz, Zehan Wang, and Wenzhe Shi. Photo-realistic single image super-resolution using a generative adversarial network. In 2017 IEEE Con...

    2017

  15. [21]

    Xudong Mao, Qing Li, Haoran Xie, Raymond Y . K. Lau, Zhen Wang, and Stephen Paul Smolley. Least squares generative adversarial networks. In IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22-29, 2017, pages 2813–2821, 2017

    2017

  16. [22]

    Spectral normalization for generative adversarial networks

    Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. In International Conference on Learning Representations, 2018

    2018

  17. [23]

    Generalization bounds of SGLD for non-convex learning: Two theoretical viewpoints

    Wenlong Mou, Liwei Wang, Xiyu Zhai, and Kai Zheng. Generalization bounds of SGLD for non-convex learning: Two theoretical viewpoints. In Conference On Learning Theory, COLT 2018, Stockholm, Sweden, 6-9 July 2018., pages 605–638, 2018

    2018

  18. [24]

    f-gan: Training generative neural sam- plers using variational divergence minimization

    Sebastian Nowozin, Botond Cseke, and Ryota Tomioka. f-gan: Training generative neural sam- plers using variational divergence minimization. In Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, December 5-10, ...

    2016

  19. [25]

    Loss-sensitive generative adversarial networks on lipschitz densities

    Guo-Jun Qi. Loss-sensitive generative adversarial networks on lipschitz densities. CoRR, abs/1701.06264, 2017

    2017 arXiv

  20. [26]

    Unsupervised representation learning with deep convolutional generative adversarial networks

    Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. In 4th International Conference on Learn- ing Representations, ICLR 2016, San Juan, Puerto Rico, May 2-4, 2016, Conference Track Proceed...

    2016

  21. [27]

    Bayesian GAN

    Yunus Saatci and Andrew Wilson. Bayesian GAN. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, 4-9 December 2017, Long Beach, CA, USA, pages 3625–3634, 2017

    2017

  22. [28]

    Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen

    Tim Salimans, Ian J. Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, December 5-10, 2016, Bar...

    2016

  23. [29]

    Tim Salimans and Diederik P. Kingma. Weight normalization: A simple reparameterization to accelerate training of deep neural networks. In Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, December 5-10, 2016,...

    2016

  24. [30]

    Learnability, stability and uniform convergence

    Shai Shalev-Shwartz, Ohad Shamir, Nathan Srebro, and Karthik Sridharan. Learnability, stability and uniform convergence. Journal of Machine Learning Research, 11:2635–2670, 2010

    2010

  25. [31]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, pages 3–18, 2017

    2017

  26. [32]

    Towards demystifying membership inference attacks

    Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Lei Yu, and Wenqi Wei. Towards demystifying membership inference attacks. CoRR, abs/1807.09173, 2018

    2018 arXiv

  27. [33]

    High-dimensional probability: An introduction with applications in data science, volume 47

    Roman Vershynin. High-dimensional probability: An introduction with applications in data science, volume 47. Cambridge University Press, 2018

    2018

  28. [36]

    SRPGAN: perceptual generative adversarial network for single image super resolution

    Bingzhe Wu, Haodong Duan, Zhichao Liu, and Guangyu Sun. SRPGAN: perceptual generative adversarial network for single image super resolution. CoRR, abs/1712.05927, 2017

    2017 arXiv

  29. [37]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, United Kingdom, July 9-12, 2018, pages 268–282, 2018

    2018

  30. [38]

    Goodfellow, Dimitris N

    Han Zhang, Ian J. Goodfellow, Dimitris N. Metaxas, and Augustus Odena. Self-attention generative adversarial networks. CoRR, abs/1805.08318, 2018

    2018 arXiv

  31. [39]

    Jun-Yan Zhu, Philipp Krähenbühl, Eli Shechtman, and Alexei A. Efros. Generative visual manipulation on the natural image manifold. In Computer Vision - ECCV 2016 - 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part V, pages 597–613, 2016

    2016

  32. [40]

    Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A. Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22-29, 2017, pages 2242–2251, 2017. 11 A Appen...

    2017

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.