Pith. sign in

REVIEW 4 major objections 6 minor 52 references

DeSIA: Attribute Inference Attacks Against Limited Fixed Aggregate Statistics

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-module attack infers sensitive attributes from a small set of released aggregate statistics, reaching AUC 0.75 on census data.

desk verdict A useful new attack that deserves review, but its headline low-FPR numbers rest on a solver-verification step whose status handling is undocumented. read the letter →

arxiv 2504.18497 v1 pith:BMHQ7IM4 submitted 2025-04-25 cs.CR cs.AI

Yifeng Mao , Bozhidar Stevanoski , Yves-Alexandre de Montjoye This is my paper · ORCID
classification cs.CRcs.AI
keywords attributeinferenceaggregatestatisticsprivacyauditingconstraintintegerprogrammingshadowdatasetsmembershipcensusmicrodatareconstructionattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that releasing even a small number of aggregate statistics from a tabular dataset does not by itself protect individuals' sensitive attributes. It introduces DeSIA, an attack that combines a deterministic constraint-integer-programming check with a stochastic shadow-dataset classifier, and shows that on the PPMF census microdata this attack reaches an AUC of 0.75 and a true positive rate of 0.14 at a false positive rate of $10^{-3}$, well above reconstruction-based baselines. The authors also show the attack remains effective when the number of released aggregates is varied, when Laplace noise is added, and for users whose attributes cannot be deterministically verified, and they adapt the same machinery to membership inference. Taken together, the paper concludes that aggregation alone is not a sufficient privacy safeguard and that formal privacy mechanisms plus empirical testing are needed before fixed aggregates are released.

What carries the argument

The load-bearing mechanism is the pairing of a deterministic verification step with a stochastic fallback. The deterministic step is a constraint integer program over record multiplicities, augmented by a uniqueness constraint $\sum_{v_n \in V_n} x_{(r^1_{u^*},\ldots,r^{n-1}_{u^*},v_n)} = 1$, which encodes the attacker's knowledge that the target is the only user with that non-sensitive profile, and by a null constraint that sets the candidate sensitive value's multiplicity to zero and checks whether the system becomes infeasible. The stochastic step generates shadow datasets from auxiliary data with randomized sensitive values, evaluates the released aggregates on them, and trains a meta-classifier (logistic regression in the default configuration) to predict the target's sensitive value from the published statistics. The deterministic module supplies high-confidence predictions for vulnerable users, while the stochastic module supplies calibrated predictions for the remaining users; the paper's ablation study indicates that both modules, and the verification in particular, are needed for the reported low-false-positive performance.

What would settle it

Take a protected dataset in which no target user is unique on non-sensitive attributes (for example, duplicate every non-sensitive profile), run DeSIA, and check whether the true positive rate at a false positive rate of $10^{-3}$ falls to chance; if it does not, the uniqueness constraint is not doing the claimed work. A complementary test is to add Laplace noise large enough that no sensitive value is uniquely feasible and see whether the deterministic module's verified set becomes empty and the low-FPR advantage disappears.

Watch

Extended reading notes

Core claim

DeSIA's central claim is that attribute inference against fixed aggregate statistics can be split into two complementary tasks. A deterministic module, instantiated as a constraint integer program, first checks whether the target user's sensitive value is the only value consistent with the released statistics; it computes one feasible value using a uniqueness constraint on the target's non-sensitive profile, then forces that value to zero via a null constraint and asks the solver whether any other solution exists. If no other solution exists, the user is declared deterministically vulnerable and the value is predicted with certainty. For everyone else, a stochastic module builds many shadow datasets by sampling records from an auxiliary dataset, randomizing the sensitive attribute, evaluating the released statistics on each shadow dataset, and training a classifier to map those statistics to the target's sensitive value. The paper reports that on the PPMF dataset this combination outperforms reconstruction-based attacks both on average (AUC 0.75 versus 0.64 for the best baseline) and on the most vulnerable users (TPR 0.14 at FPR $10^{-3}$).

Load-bearing premise

The attack assumes the target user is the only person in the protected dataset with their combination of non-sensitive attributes; if that uniqueness fails, the deterministic module's verified predictions are no longer sound and the reported high-confidence performance would be inflated.

Editorial extensions

If this is right

  • An attacker who knows a target's non-sensitive attributes and uniqueness can reliably identify a subset of highly vulnerable users even when fewer than one aggregate statistic per user is released.
  • DeSIA outperforms reconstruction-based attacks not only on average AUC but at very small false positive rates, where privacy risk to the most exposed users concentrates.
  • Adding Laplace noise and releasing fewer aggregates degrade the attack's accuracy but do not reduce it to chance, so per-query noise alone is not a sufficient defense.
  • Users whose sensitive value cannot be uniquely verified remain at measurable risk: the stochastic module reaches an AUC of 0.67 on those users alone.
  • The same two-module design transfers to membership inference, reaching an AUC of 0.85, so the approach is not specific to attribute inference.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the deterministic module's high-confidence predictions are only as reliable as the uniqueness assumption, so in real datasets with duplicate non-sensitive profiles the reported TPR at low FPR should be expected to shrink; practitioners should re-run the attack on non-unique targets before relying on that number.
  • Editorial inference: the shadow-dataset construction suggests a general audit recipe: any fixed set of counting queries can be tested for attribute leakage by training the same meta-classifier on randomized shadow releases, with no reconstruction step required.
  • Editorial inference: because the stochastic module randomizes the sensitive attribute, its success isolates leakage caused by the published statistics rather than by correlations in the underlying data, a distinction that could be reused as a leakage-only testing harness for proposed release mechanisms.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes DeSIA, a two-module attack for attribute inference against a fixed set of counting aggregate statistics released from tabular data. The deterministic module formulates a constraint integer program with a target-specific uniqueness constraint and a null-constraint verification step to identify targets whose sensitive value is uniquely determined; the stochastic module trains a logistic-regression meta-classifier on shadow datasets, constructed from an auxiliary dataset with sensitive values re-sampled uniformly, to predict the sensitive value for all other targets. The authors instantiate the attack on two Census datasets, compare it with CIP and RAP reconstruction attacks, report AUC and TPR at low FPR, and include ablations, noise-robustness experiments, a likelihood-attack comparison, and a membership-inference extension. The headline result is AUC 0.75 and TPR 0.14 at FPR 10^-3 on PPMF, substantially above the reconstruction baselines.

Significance. If the results hold, DeSIA would be a useful empirical auditing tool for aggregate releases, showing that even a small number of fixed aggregates can enable targeted attribute inference. The paper avoids the imputation confound by randomizing sensitive values in the privacy game, and the two-module design is a reasonable and novel departure from pure reconstruction. The method is clearly specified, the shadow-model training is appropriately separated from the protected dataset, and the ablation study gives useful evidence about which components drive performance. The main contributions—deterministic uniqueness verification and stochastic scoring of non-verifiable users—are well motivated and, subject to the correctness concerns below, would extend the empirical-attack literature into a relatively underexplored setting.

major comments (4)
  1. [Section 3.1, Algorithm 1 (lines 22-25)] The verification step treats the absence of a returned feasible solution as proof of infeasibility, but the paper does not state how Gurobi outcomes such as TIME_LIMIT, UNKNOWN, or numerical errors are mapped to the 'no feasible solution' branch, and no solver-status statistics are reported. Since the ablation in Table 3 shows that the deterministic module carries the low-FPR performance (TPR at k=1% drops from 0.15 to 0.09 when the stochastic module is removed, and to 0.0 when verification is removed), any timeout or unknown status treated as infeasible would directly inflate the headline TPR@10^-3. Please specify the solver-status handling and report the distribution of solver statuses for the main experiments; only certified INFEASIBLE results should be accepted as verifications.
  2. [Section 4.1 and Figures 1, 5-8] All PPMF results are pooled over only 10 selected blocks, and the ACS results over 3 PUMAs, with no per-block AUC or TPR variance and no error bars on the main comparisons. Given the paper's emphasis on 'strongly outperform' and on vulnerable-user behavior, the reported superiority could be driven by a small number of high-leverage blocks. Please report per-block results and variance, or aggregated confidence intervals, for the main comparisons in Figures 1, 5, 7, and 8.
  3. [Section 5.6] The noisy-aggregate experiments add rounded Laplace noise to the published counts but do not explain how the exact equality constraints of the deterministic CIP module, and of the CIP baseline, are made feasible when the noisy counts are inconsistent. The robustness comparison in Figure 8 is therefore ambiguous: a method could appear robust because infeasible instances are silently skipped, or fragile because they are left infeasible. Please specify the feasibility handling used for all methods under noisy counts.
  4. [Section 2.5 and Section 5.1] The reconstruction baselines are described as producing a majority-vote discrete prediction, yet AUC and TPR@FPR curves require a ranking or score for every target. The paper does not state what score is used for CIP and RAP (e.g., vote share over the K reconstructed datasets, or random tie-breaking), which is necessary to interpret the AUC differences in Figures 1, 5, 7, and 10. Please specify the scoring procedure used for the baselines.
minor comments (6)
  1. [Section 6.4 vs Figure 10] The text reports an MIA AUC of 0.85, while the caption of Figure 10 states AUC = 0.75; one of these is inconsistent and should be corrected.
  2. [Section 7.2] The likelihood attack uses Phi, which is described as a probability density function, but the expression is a cumulative distribution function; please use the standard normal CDF and align the notation.
  3. [Table 3] The table columns are labeled k=10% and k=1%, while the text and Figure 1 use TPR@10^-3; the notation should be unified so the reported vulnerable-user metric is unambiguous.
  4. [Algorithm 2, line 13] The notation M <- {(Q(D_shadow_1), z_1,*), ..., (Q(D_shadow_N), z_N,*)} suggests M is a set; the line should describe the training pairs and the fitted classifier more precisely.
  5. [Section 5.6] The noise-robustness results are reported as a mean over only 3 independent noisy releases, with no variance; please report the spread or increase the number of repetitions.
  6. [Section 4.1] The threat model in Section 2.2 assumes the target user is unique in D given the non-sensitive attributes; the experimental section does not report what fraction of target users in the selected blocks actually satisfies this condition, so the reader cannot assess how much of the attack relies on this assumption.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is evaluated on held-out protected data, the stochastic module is trained on a disjoint auxiliary split with randomized labels, and the deterministic module is a constraint-satisfaction check rather than a fitted prediction.

full rationale

DeSIA's claimed contributions are empirical attack results against fixed aggregate statistics. The deterministic module (Section 3.1, Algorithm 1) takes the released aggregates Q(D), attribute domains, and the threat-model uniqueness assumption as inputs, and uses a third-party solver to check whether a target sensitive value is logically forced by adding a null constraint. This is an entailment check over the released statistics, not a fit to the target label; the target's true sensitive value is never an input to the solver. The stochastic module (Section 3.2, Algorithm 2) builds shadow datasets from the auxiliary split Daux, assigns uniformly random sensitive values to all records including the target's shadow record, evaluates the same queries Q on these shadow datasets, and trains a logistic-regression meta-classifier to map query answers to the randomized target label. The protected dataset D is a disjoint 10% split from the same Census blocks, and the reported AUC/TPR are computed on held-out randomized sensitive values in D. No parameter of the attack is fitted to Q(D) or to the target's true sensitive attribute, so the 'prediction' is not a renamed fit. The comparison baselines (CIP, RAP) are external methods cited from the literature and are evaluated under the same protocol. The paper's self-citations ([13,44] for query-based-system attack conventions and related work by the same group) are contextual and are not used to justify the attack's correctness; no uniqueness theorem or ansatz is imported from the authors' prior work to force the method's choice. Caveats such as how Gurobi timeouts are treated in the verification step and the reliance on the threat-model uniqueness assumption are correctness/robustness risks, not circularity within the stated model. Consequently, no circular step can be exhibited with the paper's own equations, and the derivation chain is self-contained against external benchmarks.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The attack's performance rests on standard empirical-attack machinery: an auxiliary dataset, a shadow-modeling procedure, and a uniqueness assumption about the target. The randomization of sensitive attributes is an evaluation choice that isolates aggregate leakage from correlation leakage. No new physical or formal entities are introduced.

free parameters (1)
  • N (number of shadow datasets) = 20000
    Chosen for the stochastic module (Section 4.3); the paper does not ablate it, so performance dependence on this hand-chosen value is unmeasured.
assumptions (4)
  • domain assumption Target user is unique in D given non-sensitive attributes (Section 2.2, used in constraint ct in Section 3.1).
    Required for the deterministic module's uniqueness constraint; if false, the deterministic verification is invalid.
  • ad hoc to paper Sensitive attribute values in the protected dataset are sampled uniformly at random from Vn (Section 2.3).
    Modeling choice to remove correlation and avoid the imputation issue; the attack's measured performance is on this synthetic distribution, not on real attribute values.
  • domain assumption Auxiliary dataset Daux is disjoint from D and drawn from a similar distribution (Section 4.1).
    The shadow datasets and stochastic classifier rely on Daux being representative of D; the split is from the same census block.
  • domain assumption Released aggregate statistics are exact counts (Section 5.6 later adds noise).
    The main evaluation assumes no noise; the noise robustness experiments relax this.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DeSIA: Attribute Inference Attacks Against Limited Fixed Aggregate Statistics." pith.science (2026). https://pith.science/paper/BMHQ7IM4

@misc{pith2026250418497,
  author       = {Pith},
  title        = {Pith review of: DeSIA: Attribute Inference Attacks Against Limited Fixed Aggregate Statistics},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BMHQ7IM4}},
  note         = {Machine review of arXiv:2504.18497}
}
abstract

Empirical inference attacks are a popular approach for evaluating the privacy risk of data release mechanisms in practice. While an active attack literature exists to evaluate machine learning models or synthetic data release, we currently lack comparable methods for fixed aggregate statistics, in particular when only a limited number of statistics are released. We here propose an inference attack framework against fixed aggregate statistics and an attribute inference attack called DeSIA. We instantiate DeSIA against the U.S. Census PPMF dataset and show it to strongly outperform reconstruction-based attacks. In particular, we show DeSIA to be highly effective at identifying vulnerable users, achieving a true positive rate of 0.14 at a false positive rate of $10^{-3}$. We then show DeSIA to perform well against users whose attributes cannot be verified and when varying the number of aggregate statistics and level of noise addition. We also perform an extensive ablation study of DeSIA and show how DeSIA can be successfully adapted to the membership inference task. Overall, our results show that aggregation alone is not sufficient to protect privacy, even when a relatively small number of aggregates are being released, and emphasize the need for formal privacy mechanisms and testing before aggregate statistics are released.

Figures

Figures reproduced from arXiv: 2504.18497 by the authors.

Figure 1
Figure 1. Performance on the PPMF dataset of our at [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Privacy game for attribute inference attack [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Adaptation of reconstruction attacks for attribute inference. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Our proposed attack. It uses two modules: (1) [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: Impact of the number of released queries on [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 5
Figure 5. Figure 5: Performance on the PPMF dataset of our at [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 7
Figure 7. Figure 7: Performance on the ACS dataset of our at [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 9
Figure 9. Figure 9: Privacy game for membership inference at [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 11
Figure 11. Figure 11: Performance on the PPMF dataset of our attack where the stochastic module MS uses different machine learning models. The inset plot shares the same axes as the main plot. 7 Discussion 7.1 Using a Different Machine Learning Model To optimize for speed, the stochastic m…
Figure 12
Figure 12. Figure 12: Performance on the PPMF dataset of our attack where the stochastic module MS uses our stan￾dard machine learning model (Logistic Regression) and a likelihood attack. The inset plot shares the same axes as the main plot. 8 Related Work Empirical attacks have been propo…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 44 canonical work pages

  1. [1]

    Regulation (EU) 2016/679 of the European Parlia- ment and of the Council of 27 April 2016 on the pro- tection of natural persons with regard to the pro- cessing of personal data and on the free movement of such data, and repealing Directive 95/46/EC 2https://www.esante.lu/ 3http://doi.org/10.14469/hpc/2232 (General Data Protection Regulation) (Text with E...

    doi:10.14469/hpc/2232 2016

  2. [2]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Bren- dan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages 308–318, 2016

    work page 2016

  3. [3]

    The 2010 census confidential- ity protections failed, here’s how and why

    John M Abowd, Tamara Adams, Robert Ashmead, David Darais, Sourya Dey, Simson L Garfinkel, Nathan Goldschlag, Daniel Kifer, Philip Leclerc, Ethan Lew, et al. The 2010 census confidential- ity protections failed, here’s how and why. Techni- cal report, National Bureau of Economic Research, 2023

    work page 2010

  4. [4]

    A linear recon- struction approach for attribute inference attacks against synthetic data

    Meenatchi Sundaram Muthu Selva Annamalai, An- drea Gadotti, and Luc Rocher. A linear recon- struction approach for attribute inference attacks against synthetic data. 2024

    work page 2024

  5. [5]

    ”what do you want from theory alone?” experimenting with tight auditing of differentially private syn- thetic data generation

    Meenatchi Sundaram Muthu Selva Annamalai, Georgi Ganev, and Emiliano De Cristofaro. ”what do you want from theory alone?” experimenting with tight auditing of differentially private syn- thetic data generation. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 4855– 4871, 2024

    work page 2024

  6. [6]

    Membership privacy in microrna-based studies

    Michael Backes, Pascal Berrang, Mathias Humbert, and Praveen Manoharan. Membership privacy in microrna-based studies. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Com- munications Security, CCS ’16, page 319–330, New York, NY, USA, 2016. Association for Computing Machinery

    work page 2016

  7. [7]

    Michelle Boorstein, Marisa Iati, and Annys Shin. Top U.S. Catholic Church official resigns after cell- phone data used to track him on Grindr and to gay bars, 2021

    work page 2021

  8. [8]

    Mem- bership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Mem- bership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022. 17

    work page 2022

Show all 52 references
  1. [9]

    The australian bureau of statistics and re- leasing frequency tables via a remote server

    James Chipperfield, Daniel Gow, and Bronwyn Loong. The australian bureau of statistics and re- leasing frequency tables via a remote server. Sta- tistical Journal of the IAOS , 32(1):53–64, 2016

    2016

  2. [10]

    Label- only membership inference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label- only membership inference attacks. In Interna- tional conference on machine learning, pages 1964–

    1964

  3. [11]

    The power of the dinur-nissim algorithm: breaking privacy of statistical and graph databases

    Krzysztof Choromanski and Tal Malkin. The power of the dinur-nissim algorithm: breaking privacy of statistical and graph databases. In Proceedings of the 31st ACM SIGMOD-SIGACT-SIGAI sympo- sium on Principles of Database Systems , pages 65– 76, 2012

    2012

  4. [12]

    Linear pro- gram reconstruction in practice

    Aloni Cohen and Kobbi Nissim. Linear pro- gram reconstruction in practice. arXiv preprint arXiv:1810.05692, 2018

    2018 arXiv

  5. [13]

    Querys- nout: Automating the discovery of attribute in- ference attacks against query-based systems

    Ana-Maria Cretu, Florimond Houssiau, Antoine Cully, and Yves-Alexandre de Montjoye. Querys- nout: Automating the discovery of attribute in- ference attacks against query-based systems. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , p...

    2022

  6. [14]

    Confidence-ranked reconstruc- tion of census microdata from published statistics

    Travis Dick, Cynthia Dwork, Michael Kearns, Ter- rance Liu, Aaron Roth, Giuseppe Vietri, and Zhi- wei Steven Wu. Confidence-ranked reconstruc- tion of census microdata from published statistics. Proceedings of the National Academy of Sciences , 120(8):e2218605120, 2023

    2023

  7. [15]

    Retiring adult: New datasets for fair machine learning, 2022

    Frances Ding, Moritz Hardt, John Miller, and Lud- wig Schmidt. Retiring adult: New datasets for fair machine learning, 2022

    2022

  8. [16]

    Revealing infor- mation while preserving privacy

    Irit Dinur and Kobbi Nissim. Revealing infor- mation while preserving privacy. In Proceedings of the twenty-second ACM SIGMOD-SIGACT- SIGART symposium on Principles of database sys- tems, pages 202–210, 2003

    2003

  9. [17]

    The price of privacy and the limits of lp de- coding

    Cynthia Dwork, Frank McSherry, and Kunal Tal- war. The price of privacy and the limits of lp de- coding. In Proceedings of the thirty-ninth annual ACM Symposium on Theory of Computing , pages 85–94, 2007

    2007

  10. [18]

    New effi- cient attacks on statistical disclosure control mech- anisms

    Cynthia Dwork and Sergey Yekhanin. New effi- cient attacks on statistical disclosure control mech- anisms. In Advances in Cryptology–CRYPTO 2008: 28th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2008. Pro- ceedings 28, pages 469–480. Sprin...

    2008

  11. [19]

    Diffix: High-utility database anonymiza- tion

    Paul Francis, Sebastian Probst Eide, and Reinhard Munz. Diffix: High-utility database anonymiza- tion. In Privacy Technologies and Policy: 5th An- nual Privacy Forum, APF 2017, Vienna, Austria, June 7-8, 2017, Revised Selected Papers 5 , pages 141–158. Springer, 2017

    2017

  12. [20]

    Pri- vacy in pharmacogenetics: An {End-to-End} case study of personalized warfarin dosing

    Matthew Fredrikson, Eric Lantz, Somesh Jha, Si- mon Lin, David Page, and Thomas Ristenpart. Pri- vacy in pharmacogenetics: An {End-to-End} case study of personalized warfarin dosing. In 23rd USENIX Security Symposium (USENIX Security 14), pages 17–32, 2014

    2014

  13. [21]

    When the signal is in the noise: Exploiting diffix’s sticky noise

    Andrea Gadotti, Florimond Houssiau, Luc Rocher, Benjamin Livshits, and Yves-Alexandre De Mon- tjoye. When the signal is in the noise: Exploiting diffix’s sticky noise. In 28th USENIX Security Sym- posium (USENIX Security 19) , pages 1081–1098, 2019

    2019

  14. [22]

    Gurobi Optimizer Ref- erence Manual, 2024

    Gurobi Optimization, LLC. Gurobi Optimizer Ref- erence Manual, 2024

    2024

  15. [23]

    Resolving individuals contributing trace amounts of dna to highly com- plex mixtures using high-density snp genotyping microarrays

    Nils Homer, Szabolcs Szelinger, Margot Redman, David Duggan, Waibhav Tembe, Jill Muehling, John V Pearson, Dietrich A Stephan, Stanley F Nelson, and David W Craig. Resolving individuals contributing trace amounts of dna to highly com- plex mixtures using high-density snp genot...

    2008

  16. [24]

    Tapas: a toolbox for adversarial pri- vacy auditing of synthetic data

    Florimond Houssiau, James Jordon, Samuel N Co- hen, Owen Daniel, Andrew Elliott, James Geddes, Callum Mole, Camila Rangel-Smith, and Lukasz Szpruch. Tapas: a toolbox for adversarial pri- vacy auditing of synthetic data. arXiv preprint arXiv:2211.06550, 2022. 18

    2022 arXiv

  17. [25]

    A new statistic and its power to infer membership in a genome-wide asso- ciation study using genotype frequencies

    Kevin B Jacobs, Meredith Yeager, Sholom Wa- cholder, David Craig, Peter Kraft, David J Hunter, Justin Paschal, Teri A Manolio, Margaret Tucker, Robert N Hoover, et al. A new statistic and its power to infer membership in a genome-wide asso- ciation study using genotype frequen...

    2009

  18. [26]

    Are attribute inference attacks just imputation? In Proceedings of the 2022 ACM SIGSAC Conference on Com- puter and Communications Security , pages 1569– 1582, 2022

    Bargav Jayaraman and David Evans. Are attribute inference attacks just imputation? In Proceedings of the 2022 ACM SIGSAC Conference on Com- puter and Communications Security , pages 1569– 1582, 2022

    2022

  19. [27]

    The power of linear reconstruc- tion attacks

    Shiva Prasad Kasiviswanathan, Mark Rudelson, and Adam Smith. The power of linear reconstruc- tion attacks. In Proceedings of the twenty-fourth annual ACM-SIAM symposium on Discrete algo- rithms, pages 1415–1433. SIAM, 2013

    2013

  20. [28]

    The price of privately releasing contingency tables and the spectra of random matrices with correlated rows

    Shiva Prasad Kasiviswanathan, Mark Rudelson, Adam Smith, and Jonathan Ullman. The price of privately releasing contingency tables and the spectra of random matrices with correlated rows. In Proceedings of the forty-second ACM symposium on Theory of computing , pages 775–784, 2010

    2010

  21. [29]

    Iterative methods for private synthetic data: Unify- ing framework and new methods

    Terrance Liu, Giuseppe Vietri, and Steven Z Wu. Iterative methods for private synthetic data: Unify- ing framework and new methods. Advances in Neu- ral Information Processing Systems , 34:690–702, 2021

    2021

  22. [30]

    Statistical inference considered harmful

    Frank McSherry. Statistical inference considered harmful. https://github.com/frankmcsherry/b log/blob/master/posts/2016-06-14.md , 2016. [Accessed 13-04-2025]

    2016

  23. [31]

    Achilles’ heels: vulnerable record identification in syn- thetic data publishing

    Matthieu Meeus, Florent Guepin, Ana-Maria Cret ¸u, and Yves-Alexandre de Montjoye. Achilles’ heels: vulnerable record identification in syn- thetic data publishing. In European Symposium on Research in Computer Security , pages 380–399. Springer, 2023

    2023

  24. [32]

    Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models

    Shagufta Mehnaz, Sayanton V Dibbo, Roberta De Viti, Ehsanul Kabir, Bj¨ orn B Brandenburg, Ste- fan Mangard, Ninghui Li, Elisa Bertino, Michael Backes, Emiliano De Cristofaro, et al. Are your sensitive attributes private? novel model inversion attribute inference attacks on cla...

    2022

  25. [33]

    Adversary instantiation: Lower bounds for differentially pri- vate machine learning

    Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. Adversary instantiation: Lower bounds for differentially pri- vate machine learning. In 2021 IEEE Symposium on security and privacy (SP), pages 866–882. IEEE, 2021

    2021

  26. [34]

    Revisions to the standards for the classification of federal data on race and ethnicity

    Office of Management and Budget. Revisions to the standards for the classification of federal data on race and ethnicity. 1997

    1997

  27. [35]

    Table builder problem- confidentiality for linked tables

    Christine M O’Keefe, Stephen Haslett, David Steel, and Ray Chambers. Table builder problem- confidentiality for linked tables. 2008

    2008

  28. [36]

    How to dp-fy ml: A practical guide to machine learning with differential privacy

    Natalia Ponomareva, Hussein Hazimeh, Alex Ku- rakin, Zheng Xu, Carson Denison, H Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta. How to dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligenc...

    2023

  29. [37]

    Reconstruction Attacks in Practice

    Differential Privacy. Reconstruction Attacks in Practice. https://differentialprivacy.org/di ffix-attack/. [Accessed 01-02-2024]

    2024

  30. [38]

    On Location, Time, and Mem- bership: Studying How Aggregate Location Data Can Harm Users’ Privacy

    Apostolos Pyrgelis. On Location, Time, and Mem- bership: Studying How Aggregate Location Data Can Harm Users’ Privacy. https://www.benthams gaze.org/2018/10/02/on-location-time-and -membership-studying-how-aggregate-locat ion-data-can-harm-users-privacy . [Accessed 01-02-2024]

    2018

  31. [39]

    Knock knock, who’s there? membership inference on aggregate location data

    Apostolos Pyrgelis, Carmela Troncoso, and Emil- iano De Cristofaro. Knock knock, who’s there? membership inference on aggregate location data. arXiv preprint arXiv:1708.06145 , 2017

    2017 arXiv

  32. [40]

    Confidentiality and differential privacy in the dissemination of frequency tables

    Yosef Rinott, Christine M O’Keefe, Natalie Shlomo, and Chris Skinner. Confidentiality and differential privacy in the dissemination of frequency tables. Statistical Science, 33(3):358–385, 2018. 19

    2018

  33. [41]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246 , 2018

    2018 arXiv

  34. [42]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP) , pages 3–

    2017

  35. [43]

    Synthetic data – anonymisation ground- hog day

    Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic data – anonymisation ground- hog day. In 31st USENIX Security Symposium (USENIX Security 22) , pages 1451–1468, Boston, MA, August 2022. USENIX Association

    2022

  36. [44]

    Querycheetah: Fast au- tomated discovery of attribute inference attacks against query-based systems

    Bozhidar Stevanoski, Ana-Maria Cretu, and Yves- Alexandre de Montjoye. Querycheetah: Fast au- tomated discovery of attribute inference attacks against query-based systems. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages 3451–...

    2024

  37. [45]

    Defending against recon- struction attacks with r´ enyi differential privacy

    Pierre Stock, Igor Shilov, Ilya Mironov, and Alexandre Sablayrolles. Defending against recon- struction attacks with r´ enyi differential privacy. arXiv preprint arXiv:2202.07623 , 2022

    2022 arXiv

  38. [46]

    Census Bureau

    U.S. Census Bureau. American community survey (acs), 2020. Aggregated survey data used for trend analysis and public reporting

    2020

  39. [47]

    Census Bureau

    U.S. Census Bureau. Developing the das: Demonstration data and progress met- rics. https://www.census.gov/programs- surveys/decennial-census/decade/2020/planning- management/process/disclosure-avoidance/2020- das-development.html, 2020

    2020

  40. [48]

    Learning your identity and disease from research papers: information leaks in genome wide association study

    Rui Wang, Yong Fuga Li, XiaoFeng Wang, Haixu Tang, and Xiaoyong Zhou. Learning your identity and disease from research papers: information leaks in genome wide association study. In Proceedings of the 16th ACM conference on Computer and com- munications security, pages 534–544, 2009

    2009

  41. [49]

    Winning the midst challenge: New membership inference attacks on diffusion mod- els for tabular data synthesis

    Xiaoyu Wu, Yifei Pang, Terrance Liu, and Steven Wu. Winning the midst challenge: New membership inference attacks on diffusion mod- els for tabular data synthesis. arXiv preprint arXiv:2503.12008, 2025

    2025 arXiv

  42. [50]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations sympo- sium (CSF), pages 268–282. IEEE, 2018

    2018

  43. [51]

    Low-cost high-power membership inference attacks

    Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high-power membership inference attacks. arXiv preprint arXiv:2312.03262 , 2023

    2023 arXiv

  44. [52]

    On the (in) feasibility of attribute infer- ence attacks on machine learning models

    Benjamin Zi Hao Zhao, Aviral Agrawal, Catisha Coburn, Hassan Jameel Asghar, Raghav Bhaskar, Mohamed Ali Kaafar, Darren Webb, and Peter Dickinson. On the (in) feasibility of attribute infer- ence attacks on machine learning models. In 2021 IEEE European Symposium on Security an...

    2021

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.