In this paper we show strategies to easily identify fake samples generated with the Generative Adversarial Network framework. One strategy is based on the statistical analysis and comparison of raw pixel values and features extracted from them. The other strategy learns formal specifications from the real data and shows that fake samples violate the specifications of the real data. We show that fake samples produced with GANs have a universal signature that can be used to identify fake samples. We provide results on MNIST, CIFAR10, music and speech data. Fake samples generated with the Generative Adversarial Networks BID5 framework have fooled humans and machines to believe that they are indistinguishable from real samples. Although this might be true for the naked eye and the discriminator fooled by the generator, it is unlikely that fake samples are numerically indistinguishable from real samples. Inspired by formal methods, this paper focuses on the evaluation of fake samples with respect to statistical summaries and formal specifications computed on the real data.Since the Generative Adversarial Networks paper BID5 , most GAN related publications use a grid of image samples to accompany theoretical and empirical results. Unlike Variational Autoencoders (VAEs) and other models BID5 , most of the evaluation of the output of GAN trained Generators is qualitative: authors normally list higher sample quality as one of the advantages of their method over other methods. Although numerical measures like the inception score are used to evaluate GAN samples BID13 , interestingly, little is mentioned about the numerical properties of fake samples and how these properties compare to real samples.In the context of Verified Artificial Intelligence BID14 , it is hard to systematically verify that the output of a model satisfies the specifications of the data it was trained on, specially when verification depends on the existence of perceptually meaningful features. For example, consider a model that generates images of humans: although it is possible to compare color histograms of real and fake samples, we do not yet have robust algorithms to verify if an image follows specifications derived from anatomy. This paper is related to the systematic verification of fake samples and focuses on comparing numerical properties of fake and real samples. In addition to comparing statistical summaries, we investigate how the Generator approximates modes in the real distribution and verify if the generated samples violate specifications derived from it. We offer the following main contributions:• We show that fake samples have properties that are barely noticed with visual inspection• We show that these properties can be used to identify the source of the data (real or fake)• We show that fake samples violate formal specifications learned from real data 2 RELATED WORK Despite its youth, several publications ( BID0 , BID13 , BID15 , BID12 ) have investigated the use of the GAN framework for sample generation and unsupervised feature learning. Following the procedure described in BID3 and used in BID5 , earlier GAN papers evaluated the quality of the fake samples by fitting a Gaussian Parzen window 1 to the fake samples and reporting the log-likelihood of the test set under this distribution. As mentioned in BID5 , this method has some drawbacks, including its high variance and bad performance in high dimensional spaces. The inception score is another widely adopted evaluation metric that fails to provide systematic guidance on the evaluation of GAN models BID2 .Unlike other optimization problems, where analysis of the empirical risk is a strong indicator of progress, in GANs the decrease in loss is not always correlated with increase in image quality , and thus authors still rely on visual inspection of generated images. Based on visual inspection, authors confirm that they have not observed mode collapse or that their framework is robust to mode collapse if some criteria is met ( , BID7 , BID9 , BID12 ). In practice , github issues where practitioners report mode collapse or not enough variety abound.In their publications, BID9 , and BID7 propose alternative objective functions and algorithms that circumvent problems that are common when using the original GAN objective described in BID5 . The problems addressed include instability of learning, mode collapse and meaningful loss curves BID13 .These alternatives do not eliminate the need, or excitement 2 , to visually inspect GAN samples during training, nor do they provide quantitative information about the generated samples. In this paper we investigated numerical properties of samples produced with adversarial methods, specially Generative Adversarial Networks. We showed that fake samples have properties that are barely noticed with visual inspection of samples, namely the fact that fake samples smoothly approximate the dominating modes of the distribution due to stochastic gradient descent and the requirements of differentiability. We analysed statistical measures of divergence between real data and other data and the results showed that even in simple cases, e.g. distribution of pixel intensities, the divergence between training data and fake data is large with respect to test data. Finally, we mined specifications from real data and showed that, unlike test data, the fake data considerably violates the specifications of the real data.In the context of adversarial attacks, these large differences in distribution and specially violations of specification can be used to identify data that is fake. In our results we show that, although some of the features used to learn specifications in this paper are weakly perceptually correlated with the content of the image, they certainly can be used to identify fake samples.Although not common practice, one could possibly circumvent the difference in support between the real and fake data by training Generators that explicitly sample a distribution that replicates the support of the real data, i.e. 256 values in the case of discretized images. Conversely, one could mine specifications that are easy to learn from real data but hardly differentiable. These are topics that are not limited to GANs and remain to be explored in the larger domain of Verified Artificial Intelligence considered in BID14 .We are thankful to Ryan Prenger and Kevin Shih for their feedback on this paper. We acknowledge NVIDIA for providing us with the Titan X GPU used in these experiments.APPENDIX A SPECTRAL CENTROID AND SLOPE IMAGES
We show strategies to easily identify fake samples generated with the Generative Adversarial Network framework. Show that fake samples created with common generative adversarial network (GAN) implementations are easily identified using various statistical techniques.  The paper proposes statistics to identify fake data generated using GANs based on simple marginal statistics or formal specifications automatically generated from real data.