{"id":"9b4058f5-44d8-4d80-a3a7-e50d7f73cdd1","arxiv_id":"2504.18497","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"DeSIA infers sensitive attributes from limited fixed aggregate statistics by first checking whether a value is uniquely forced by the counts, then using a shadow-model classifier, outperforming reconstruction baselines on census microdata.","lead":"The paper introduces DeSIA, an attack that infers a person's private attribute from a small set of published census count tables, and shows it beats existing reconstruction-based attacks. The method combines a deterministic check for uniquely inferable values with a machine-learning model trained on shadow copies of the data.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Deterministic verification may be unsound if Gurobi timeouts are treated as infeasibility; this would inflate the headline TPR@1e-3.","rationale":"The reader's weakest_assumption is the target-uniqueness condition (Sec. 2.2, ct in Sec. 3.1). That assumption is explicitly stated in the threat model, so within the stated model it is not an internal inconsistency. I see a more immediate load-bearing risk: the verification step's correctness depends on the MIP solver returning a genuine infeasibility certificate, and the paper provides no evidence about time limits or status handling. Because the headline low-FPR metric is driven by deterministic predictions, a failure here would directly invalidate the central claim. The reader already conditioned acceptance on clarifying solver infeasibility handling, so my concern reinforces the CONDITIONAL verdict rather than moving it. If the audit shows all verification solves return rigorous INFEASIBLE statuses, the reported numbers stand; if not, the claim needs re-estimation. This is addressable with released code and a small script, matching the reader's conditions.","tokens_in":19518,"tokens_out":14000,"duration_ms":141051,"concrete_test":"Audit the deterministic module on the PPMF targets: for every run of Algorithm 1 and the verification solve, record Gurobi status (OPTIMAL, INFEASIBLE, TIME_LIMIT, UNKNOWN, etc.). Recompute AUC and TPR@1e-3 after excluding all predictions produced when the verification solver did not return a rigorous INFEASIBLE status. In addition, for a random sample of 100 targets labeled 'verified', re-solve the verification MIP with a 10x larger time limit to confirm that no feasible solution exists; if any such sample yields a feasible solution, the deterministic verifier is unsound.","verdict_should_be":"UNCHANGED","load_bearing_attack":"DeSIA's central claim—AUC 0.75 and TPR@1e-3=0.14 on PPMF—rests on the deterministic module's verification step (Algorithm 1, lines 22-25). That step accepts a value only if RunSolver on the constraint set C' returns no feasible solution. The paper does not specify how solver outcomes are handled (i.e., whether TIME_LIMIT, UNKNOWN, or numerical errors are treated as infeasible) and reports no solver status distributions for any experiment. If the implementation treats 'no solution returned within a time limit' as no feasible solution, then the uniqueness verification is unsound: a target whose sensitive value is not actually forced would be labeled deterministically vulnerable with certainty 1. Since the ablation (Table 3) shows that removing the stochastic module still leaves TPR@1%=0.09 while removing verification drops it to 0.0, the low-FPR performance is largely carried by deterministic predictions. A small fraction of false 'verified' outputs would materially inflate the strongest claim. The uniqueness assumption highlighted by the reader is explicit in the threat model (Sec. 2.2) and is not a flaw within that model; the solver-status gap is a correctness risk inside the stated model.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DeSIA, a two-module attack for attribute inference against a fixed set of counting aggregate statistics released from tabular data. The deterministic module formulates a constraint integer program with a target-specific uniqueness constraint and a null-constraint verification step to identify targets whose sensitive value is uniquely determined; the stochastic module trains a logistic-regression meta-classifier on shadow datasets, constructed from an auxiliary dataset with sensitive values re-sampled uniformly, to predict the sensitive value for all other targets. The authors instantiate the attack on two Census datasets, compare it with CIP and RAP reconstruction attacks, report AUC and TPR at low FPR, and include ablations, noise-robustness experiments, a likelihood-attack comparison, and a membership-inference extension. The headline result is AUC 0.75 and TPR 0.14 at FPR 10^-3 on PPMF, substantially above the reconstruction baselines.","tokens_in":19756,"tokens_out":6365,"duration_ms":68048,"significance":"If the results hold, DeSIA would be a useful empirical auditing tool for aggregate releases, showing that even a small number of fixed aggregates can enable targeted attribute inference. The paper avoids the imputation confound by randomizing sensitive values in the privacy game, and the two-module design is a reasonable and novel departure from pure reconstruction. The method is clearly specified, the shadow-model training is appropriately separated from the protected dataset, and the ablation study gives useful evidence about which components drive performance. The main contributions—deterministic uniqueness verification and stochastic scoring of non-verifiable users—are well motivated and, subject to the correctness concerns below, would extend the empirical-attack literature into a relatively underexplored setting.","major_comments":[{"comment":"The verification step treats the absence of a returned feasible solution as proof of infeasibility, but the paper does not state how Gurobi outcomes such as TIME_LIMIT, UNKNOWN, or numerical errors are mapped to the 'no feasible solution' branch, and no solver-status statistics are reported. Since the ablation in Table 3 shows that the deterministic module carries the low-FPR performance (TPR at k=1% drops from 0.15 to 0.09 when the stochastic module is removed, and to 0.0 when verification is removed), any timeout or unknown status treated as infeasible would directly inflate the headline TPR@10^-3. Please specify the solver-status handling and report the distribution of solver statuses for the main experiments; only certified INFEASIBLE results should be accepted as verifications.","section":"Section 3.1, Algorithm 1 (lines 22-25)"},{"comment":"All PPMF results are pooled over only 10 selected blocks, and the ACS results over 3 PUMAs, with no per-block AUC or TPR variance and no error bars on the main comparisons. Given the paper's emphasis on 'strongly outperform' and on vulnerable-user behavior, the reported superiority could be driven by a small number of high-leverage blocks. Please report per-block results and variance, or aggregated confidence intervals, for the main comparisons in Figures 1, 5, 7, and 8.","section":"Section 4.1 and Figures 1, 5-8"},{"comment":"The noisy-aggregate experiments add rounded Laplace noise to the published counts but do not explain how the exact equality constraints of the deterministic CIP module, and of the CIP baseline, are made feasible when the noisy counts are inconsistent. The robustness comparison in Figure 8 is therefore ambiguous: a method could appear robust because infeasible instances are silently skipped, or fragile because they are left infeasible. Please specify the feasibility handling used for all methods under noisy counts.","section":"Section 5.6"},{"comment":"The reconstruction baselines are described as producing a majority-vote discrete prediction, yet AUC and TPR@FPR curves require a ranking or score for every target. The paper does not state what score is used for CIP and RAP (e.g., vote share over the K reconstructed datasets, or random tie-breaking), which is necessary to interpret the AUC differences in Figures 1, 5, 7, and 10. Please specify the scoring procedure used for the baselines.","section":"Section 2.5 and Section 5.1"}],"minor_comments":[{"comment":"The text reports an MIA AUC of 0.85, while the caption of Figure 10 states AUC = 0.75; one of these is inconsistent and should be corrected.","section":"Section 6.4 vs Figure 10"},{"comment":"The likelihood attack uses Phi, which is described as a probability density function, but the expression is a cumulative distribution function; please use the standard normal CDF and align the notation.","section":"Section 7.2"},{"comment":"The table columns are labeled k=10% and k=1%, while the text and Figure 1 use TPR@10^-3; the notation should be unified so the reported vulnerable-user metric is unambiguous.","section":"Table 3"},{"comment":"The notation M <- {(Q(D_shadow_1), z_1,*), ..., (Q(D_shadow_N), z_N,*)} suggests M is a set; the line should describe the training pairs and the fitted classifier more precisely.","section":"Algorithm 2, line 13"},{"comment":"The noise-robustness results are reported as a mean over only 3 independent noisy releases, with no variance; please report the spread or increase the number of repetitions.","section":"Section 5.6"},{"comment":"The threat model in Section 2.2 assumes the target user is unique in D given the non-sensitive attributes; the experimental section does not report what fraction of target users in the selected blocks actually satisfies this condition, so the reader cannot assess how much of the attack relies on this assumption.","section":"Section 4.1"}],"recommendation":"major_revision","confidential_remarks":"The central idea is promising and the experimental framing is generally sound, but the solver-status handling in the deterministic module is a correctness risk for the headline low-FPR claim, and the lack of per-block variance weakens the generality of the comparison. If the authors can certify that only INFEASIBLE solver statuses are used and add the requested robustness reporting, I would be willing to support acceptance after the revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"DeSIA is a genuine step forward for attribute inference against fixed aggregates: combining deterministic uniqueness verification with a shadow-model classifier is new, and it beats the CIP/RAP baselines by a clear margin on the PPMF setup. The privacy-game framing is useful, and randomizing the sensitive attribute is the right way to avoid the imputation confound. The ablation is honest: every component earns its place, and the noise robustness and MIA extension make the method look like a coherent toolkit, not a single-dataset trick.\n\nThe main weakness is exactly where the reader and stress-test point. The headline TPR@1e-3 is carried by the deterministic module, and the deterministic module's verification step calls Gurobi and treats \"no feasible solution\" as proof. The paper never says how solver statuses are handled: whether TIME_LIMIT or UNKNOWN are taken as infeasible, whether a time limit exists, or what fraction of calls return each status. If any timeout is counted as infeasible, the \"verified\" prediction is not verified, and the low-FPR numbers are inflated by false certainty. This is not a hypothetical concern about the threat model; it is inside the stated model. It is fixable by reporting statuses and rerunning with proper barriers, but the paper as written leaves the central claim on an unspecified implementation detail.\n\nSecondary gaps are more ordinary. No error bars or per-block variance; only 10 blocks from the top 1% of census blocks; no code or data release to check the shadow-model training. N=20000 is specified, but the meta-classifier configuration is under-specified. These are addressable. The absolute effect sizes are moderate (AUC 0.75 vs 0.64), so \"strongly outperform\" is a bit generous, but for privacy auditing, the low-FPR regime is the right place to look, and the gap there is real if the solver handling is sound.\n\nBottom line: this paper deserves a serious referee. I would not take the headline numbers on faith until the solver-status question is resolved and artifacts are available, but the method is sensible, the evaluation is broad, and the problem is well chosen. Send it; ask for clarity on solver statuses and variance before publication.","headline":"A useful new attack that deserves review, but its headline low-FPR numbers rest on a solver-verification step whose status handling is undocumented.","tokens_in":20259,"tokens_out":2195,"would_cite":true,"duration_ms":23003,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A two-module attack infers sensitive attributes from a small set of released aggregate statistics, reaching AUC 0.75 on census data.","keywords":["attribute inference","aggregate statistics","privacy auditing","constraint integer programming","shadow datasets","membership inference","census microdata","reconstruction attack"],"falsifier":"Take a protected dataset in which no target user is unique on non-sensitive attributes (for example, duplicate every non-sensitive profile), run DeSIA, and check whether the true positive rate at a false positive rate of $10^{-3}$ falls to chance; if it does not, the uniqueness constraint is not doing the claimed work. A complementary test is to add Laplace noise large enough that no sensitive value is uniquely feasible and see whether the deterministic module's verified set becomes empty and the low-FPR advantage disappears.","tokens_in":19324,"feed_emoji":"🕵️","tokens_out":8154,"duration_ms":69836,"temperature":0.7,"pith_summary":"The paper argues that releasing even a small number of aggregate statistics from a tabular dataset does not by itself protect individuals' sensitive attributes. It introduces DeSIA, an attack that combines a deterministic constraint-integer-programming check with a stochastic shadow-dataset classifier, and shows that on the PPMF census microdata this attack reaches an AUC of 0.75 and a true positive rate of 0.14 at a false positive rate of $10^{-3}$, well above reconstruction-based baselines. The authors also show the attack remains effective when the number of released aggregates is varied, when Laplace noise is added, and for users whose attributes cannot be deterministically verified, and they adapt the same machinery to membership inference. Taken together, the paper concludes that aggregation alone is not a sufficient privacy safeguard and that formal privacy mechanisms plus empirical testing are needed before fixed aggregates are released.","feed_headline":"Aggregate statistics leak sensitive attributes at AUC 0.75","feed_subtitle":"A two-module attack finds vulnerable users even when fewer than one statistic per person is released.","key_machinery":"The load-bearing mechanism is the pairing of a deterministic verification step with a stochastic fallback. The deterministic step is a constraint integer program over record multiplicities, augmented by a uniqueness constraint $\\sum_{v_n \\in V_n} x_{(r^1_{u^*},\\ldots,r^{n-1}_{u^*},v_n)} = 1$, which encodes the attacker's knowledge that the target is the only user with that non-sensitive profile, and by a null constraint that sets the candidate sensitive value's multiplicity to zero and checks whether the system becomes infeasible. The stochastic step generates shadow datasets from auxiliary data with randomized sensitive values, evaluates the released aggregates on them, and trains a meta-classifier (logistic regression in the default configuration) to predict the target's sensitive value from the published statistics. The deterministic module supplies high-confidence predictions for vulnerable users, while the stochastic module supplies calibrated predictions for the remaining users; the paper's ablation study indicates that both modules, and the verification in particular, are needed for the reported low-false-positive performance.","core_discovery":"DeSIA's central claim is that attribute inference against fixed aggregate statistics can be split into two complementary tasks. A deterministic module, instantiated as a constraint integer program, first checks whether the target user's sensitive value is the only value consistent with the released statistics; it computes one feasible value using a uniqueness constraint on the target's non-sensitive profile, then forces that value to zero via a null constraint and asks the solver whether any other solution exists. If no other solution exists, the user is declared deterministically vulnerable and the value is predicted with certainty. For everyone else, a stochastic module builds many shadow datasets by sampling records from an auxiliary dataset, randomizing the sensitive attribute, evaluating the released statistics on each shadow dataset, and training a classifier to map those statistics to the target's sensitive value. The paper reports that on the PPMF dataset this combination outperforms reconstruction-based attacks both on average (AUC 0.75 versus 0.64 for the best baseline) and on the most vulnerable users (TPR 0.14 at FPR $10^{-3}$).","pith_inferences":["Editorial inference: the deterministic module's high-confidence predictions are only as reliable as the uniqueness assumption, so in real datasets with duplicate non-sensitive profiles the reported TPR at low FPR should be expected to shrink; practitioners should re-run the attack on non-unique targets before relying on that number.","Editorial inference: the shadow-dataset construction suggests a general audit recipe: any fixed set of counting queries can be tested for attribute leakage by training the same meta-classifier on randomized shadow releases, with no reconstruction step required.","Editorial inference: because the stochastic module randomizes the sensitive attribute, its success isolates leakage caused by the published statistics rather than by correlations in the underlying data, a distinction that could be reused as a leakage-only testing harness for proposed release mechanisms."],"forward_implications":["An attacker who knows a target's non-sensitive attributes and uniqueness can reliably identify a subset of highly vulnerable users even when fewer than one aggregate statistic per user is released.","DeSIA outperforms reconstruction-based attacks not only on average AUC but at very small false positive rates, where privacy risk to the most exposed users concentrates.","Adding Laplace noise and releasing fewer aggregates degrade the attack's accuracy but do not reduce it to chance, so per-query noise alone is not a sufficient defense.","Users whose sensitive value cannot be uniquely verified remain at measurable risk: the stochastic module reaches an AUC of 0.67 on those users alone.","The same two-module design transfers to membership inference, reaching an AUC of 0.85, so the approach is not specific to attribute inference."],"supporting_citations":[{"why":"Defines the CIP constraint-integer-programming reconstruction attack that the deterministic module modifies and also uses as a state-of-the-art baseline.","marker":"[3]"},{"why":"Proposes the RAP synthetic-data reconstruction attack and the census contingency-table evaluation setup that the paper uses for comparison.","marker":"[14]"},{"why":"Supplies the PPMF census microdata release and block-level contingency tables on which the main results are reported.","marker":"[47]"},{"why":"Provides the third-party constraint solver used to run the CIP formulations and the deterministic module.","marker":"[22]"},{"why":"Establishes TPR at a fixed low FPR as the privacy metric used to measure risk to the most vulnerable users.","marker":"[8]"},{"why":"Introduces the shadow-model technique that the stochastic module adapts into shadow datasets for training its classifier.","marker":"[42]"}],"fun_headline_variants":["DeSIA attack reveals attributes from only a few aggregate stats","Few aggregate stats still leak your attributes, DeSIA shows","Census data at risk: DeSIA infers attributes from aggregates","Aggregation alone won't protect privacy, new attack proves","One statistic per person? Still leaky, DeSIA finds"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the target user is the only person in the protected dataset with their combination of non-sensitive attributes; if that uniqueness fails, the deterministic module's verified predictions are no longer sound and the reported high-confidence performance would be inflated.","fun_headline_variants_meta":{"raw":{"variants":["DeSIA attack reveals attributes from only a few aggregate stats","Few aggregate stats still leak your attributes, DeSIA shows","Census data at risk: DeSIA infers attributes from aggregates","Aggregation alone won't protect privacy, new attack proves","One statistic per person? Still leaky, DeSIA finds"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00057,"raw_usage":{"total_tokens":2707,"prompt_tokens":963,"completion_tokens":1744,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":579,"completion_tokens_details":{"reasoning_tokens":1659}},"tokens_in":579,"tokens_out":1744,"duration_ms":12522,"temperature":1.0,"reasoning_tokens":1659,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:15:03.167130+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a protected dataset in which no target user is unique on non-sensitive attributes (for example, duplicate every non-sensitive profile), run DeSIA, and check whether the true positive rate at a false positive rate of $10^{-3}$ falls to chance; if it does not, the uniqueness constraint is not doing the claimed work. A complementary test is to add Laplace noise large enough that no sensitive value is uniquely feasible and see whether the deterministic module's verified set becomes empty and the low-FPR advantage disappears.","supporting_citations":[{"cited_title":"The 2010 census confidential- ity protections failed, here’s how and why","cited_arxiv_id":null,"evidence_quote":"Defines the CIP constraint-integer-programming reconstruction attack that the deterministic module modifies and also uses as a state-of-the-art baseline."},{"cited_title":"Confidence-ranked reconstruc- tion of census microdata from published statistics","cited_arxiv_id":null,"evidence_quote":"Proposes the RAP synthetic-data reconstruction attack and the census contingency-table evaluation setup that the paper uses for comparison."},{"cited_title":"Census Bureau","cited_arxiv_id":null,"evidence_quote":"Supplies the PPMF census microdata release and block-level contingency tables on which the main results are reported."},{"cited_title":"Gurobi Optimizer Ref- erence Manual, 2024","cited_arxiv_id":null,"evidence_quote":"Provides the third-party constraint solver used to run the CIP formulations and the deterministic module."},{"cited_title":"Mem- bership inference attacks from first principles","cited_arxiv_id":null,"evidence_quote":"Establishes TPR at a fixed low FPR as the privacy metric used to measure risk to the most vulnerable users."},{"cited_title":"Membership inference attacks against machine learning models","cited_arxiv_id":null,"evidence_quote":"Introduces the shadow-model technique that the stochastic module adapts into shadow datasets for training its classifier."}],"review_version":1}