Search papers, labs, and topics across Lattice.
This paper investigates membership inference attacks against statistical releases, focusing on scenarios where attackers possess knowledge of the population's attribute dependency structure modeled as a Bayesian network (BN). They re-frame the membership inference problem using Bayesian decision-making to incorporate prior information about the population, leading to more effective attacks. They introduce a specific attack instantiation using probabilistic programming that outperforms existing likelihood ratio and inner product attacks on complex BNs, demonstrating the vulnerability of statistical releases when population dependencies are known.
Knowing the attribute dependencies within a population lets attackers infer membership with surprising accuracy, even against statistical releases designed to protect privacy.
The membership inference problem for publicly released statistics from a private dataset is well-studied. When developing and formally analyzing attack strategies, however, the focus has been on attacks that model the population using only its marginals. In practice, these attacks can perform well on various populations, however most formal analysis is for populations that follow a product distribution. These strategies may fail to leverage useful information about the population that is important for understanding a realistic privacy threat. In this work, we explore the impact of providing an attacker with additional information about the attribute dependency structure of the population, motivated by examples where multiple parties may have access to similarly structured data, for example the US Census and the IRS. To model this scenario, we re-frame the membership inference problem with respect to a population represented as a Bayesian network (BN). We develop a framework based on Bayesian decision-making which can incorporate prior information about the population to launch more effective, specialized attacks. To evaluate our framework, we introduce a specific attack instantiation which computes the Bayesian posterior using a probabilistic program, and prove its equivalence to an optimal variant of the likelihood ratio test attack for two populations with strong attribute dependency. We implement our program in the Roulette probabilistic programming language and show experimentally that it outperforms the likelihood ratio test and inner product attacks on five commonly used BNs, where the population dependency structure is too complex for the existing attacks to be manually adapted.
