  Recently, generative adversarial networks (GANs) have achieved stunning
realism, fooling even human observers. Indeed, the popular tongue-in-cheek
website {\small \url{ http://thispersondoesnotexist.com}}, taunts users with
GAN generated images that seem too real to believe. On the other hand, GANs do
leak information about their training data, as evidenced by membership attacks
recently demonstrated in the literature. In this work, we challenge the
assumption that GAN faces really are novel creations, by constructing a
successful membership attack of a new kind. Unlike previous works, our attack
can accurately discern samples sharing the same identity as training samples
without being the same samples. We demonstrate the interest of our attack
across several popular face datasets and GAN training procedures. Notably, we
show that even in the presence of significant dataset diversity, an over
represented person can pose a privacy concern.
