Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack