Towards Better Attribute Inference Vulnerability Measures

David Wagner; Paul Francis

REVIEW 3 major objections 6 minor 44 references

Towards Better Attribute Inference Vulnerability Measures

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Ignoring recall in privacy metrics hides one in four attribute-inference attacks.

desk verdict A recall-aware attribute inference measure with a real baseline improvement, but the headline 25% rests on unvalidated thresholds; deserving of review with sensitivity analysis required. read the letter →

arxiv 2507.01710 v1 pith:AXOEHZQW submitted 2025-07-02 cs.CR

Paul Francis , David Wagner This is my paper

classification cs.CR

keywords attributeinferenceanonymitymeasureprecision-recallprivacybaselinesyntheticdatabestrowmatchattacklosscoefficientGDPRanonymization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Standard attribute-inference privacy measures score an attack by accuracy alone and compare it against a baseline built by running the same attack on anonymized data without the target. The paper argues that this misses attacks that achieve high precision on a small fraction of individuals, because accuracy over everyone can look low. It proposes scoring both attack and baseline by precision and recall, combining them into a Precision-Recall Coefficient (PRC) and then into an Anonymity Loss Coefficient (ALC) that compares attack against baseline. On moderately anonymized microdata with 20% random column swapping, the new measure labels over 25% of attacks as at risk or serious risk that the prior approach labels safe. The paper also releases a pip-installable Python package implementing the measure and a generic best-row-match attack.

What carries the argument

The Precision-Recall Coefficient (PRC) carries the argument. It is defined as $PRC = (1 - (\log_{10}(R)/\log_{10}(R_{\min}))^{\alpha})\cdot P$ for $R > R_{\min}$, and $PRC = R$ below it, so high precision is discounted only when recall becomes very low. The Anonymity Loss Coefficient (ALC) is then the relative gap $ALC = (PRC_{atk} - PRC_{base})/(1 - PRC_{base})$, which lets an evaluator compare attack and baseline even when their recalls differ. A secondary mechanism is the best-row-match attack's rank score, $(1-G_{\min})\cdot(M/C)$, which lets the attack abstain on low-confidence matches and thereby trade recall for precision.

What would settle it

Recompute the same 8,883 attack comparisons using an alternative composite measure such as the F-beta score, or sweep alpha, R_min, and the ALC threshold over plausible ranges; if the set of attacks newly labeled at risk changes by more than a few percent, the headline 25% false-negative result is an artifact of the chosen scoring parameters rather than of including recall.

Watch

Extended reading notes

Core claim

The central claim is that attribute-inference vulnerability is better measured as the improvement of a precision-recall profile over a strong baseline than as an accuracy advantage over a weak baseline. The paper defines the PRC as a precision score discounted by low recall, with parameters alpha and R_min that a custodian can set, and defines ALC as the relative gap between attack and baseline PRC, so a positive ALC means a measurable loss of anonymity. It then changes the baseline itself: instead of anonymizing the non-member dataset and reusing the attack predictor, it removes the target from the original data and lets any predictive model serve as the baseline. In an apples-to-apples comparison using the same best-row-match attack on nine datasets, the prior approach called 24.24% of attacks safe where the new approach sees at-risk and another 1.24% safe where the new approach sees serious risk; for strongly anonymized data the two approaches agree that the data is safe.

Load-bearing premise

The load-bearing premise is that the hand-chosen PRC parameters alpha=3 and R_min=0.0001, together with the ALC=0.5 safety threshold, correctly separate privacy-neutral inference from at-risk attacks; the paper provides no independent evidence for these specific values.

Editorial extensions

If this is right

Data custodians who adopt the measure can set an ALC threshold and automatically flag attacks above it for manual review, while treating ALC below 0.5 as safe without further analysis.
Because the baseline is computed from original data rather than an anonymized copy, it is cheaper to run, removing the cost objection that stopped the Census reconstruction analysis from using a proper baseline.
Recall-aware scoring exposes attacks that succeed only on a small subpopulation, so an anonymized release that looks safe on average can still be flagged when a few individuals are re-identifiable with high confidence.
The open-source package lets other researchers plug in new attacks and compare anonymization techniques using the same PRC/ALC score, making results across studies more directly comparable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 25% figure is conditioned on the hand-chosen PRC parameters alpha=3 and R_min=0.0001 and the ALC=0.5 threshold; the paper itself states there is no evidential basis for risk thresholds, so a natural next step is a sensitivity analysis over these values.
If ALC below 0.5 really means privacy-neutral, then the measure offers a way to operationalize the Article 29 notion of 'significant probability' in GDPR anonymization assessments, though the paper only sketches this connection.
The paper's baseline assumes the attacker has no better external statistical knowledge than what the original data minus the target provides; a stronger test would build the baseline from an independent sample of the same population and check whether the new labels survive.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's my read. The core contribution is real: attribute inference evaluation has been precision-only, and a recall-aware measure with an original-data baseline closes a genuine gap. The open-source implementation and the apples-to-apples comparison against prior approaches are concrete and useful. I'd rather have this framework than not.

But the headline "over 25%" is conditional, and the authors know it. PRC requires alpha and Rmin, and the safe/at-risk boundary is ALC=0.5. Appendix A.2 openly says there is no evidential basis for thresholds. That's honest, but it means the 25% figure is a product of those choices. Figures 4b and 4c show the PRC curves shift substantially with alpha and Rmin, and the discontinuity in Eq. 6 at R=Rmin means a tiny change in recall can flip an attack across the PRC boundary. No sensitivity analysis is provided, so we can't tell whether the 25% is robust. The experiments also use only random swapping with 20% swap, and select "attackable" configurations, which is narrow.

The measurement framework itself isn't invalidated by this; it's a useful tool and the design is thoughtfully laid out. The paper is for privacy researchers working on synthetic data and census releases, and for data custodians who need a practical risk measure. But the abstract's claim should be tempered until the authors show stability across plausible parameter ranges and a wider set of anonymization methods.

My recommendation: welcome it to peer review, but make the reviewers ask for sensitivity analysis on alpha, Rmin, and the ALC threshold, and ideally a broader set of anonymization techniques. With that, the paper could be solid. Without it, the headline claim doesn't hold up.

Referee Report

3 major / 6 minor

Summary. The paper proposes a new attribute-inference vulnerability measure for anonymized microdata, called the Anonymity Loss Coefficient (ALC), built on a composite Precision-Recall Coefficient (PRC). The ALC compares a best PRC of an attack against a best PRC of a baseline, where the baseline is computed from the original data minus the target using any predictive technique, rather than from an anonymized non-member dataset as in prior work. The paper also contributes an open-source implementation (anonymity_loss_coefficient) and a generic best-row-match attack with a quality-aware rank score. In experiments on 9 datasets with random-swap anonymization, the paper reports that over 25% of attacks classified as safe by a prior-style approach are classified as at risk or serious by the new approach, with about 24% being false negatives and a smaller number of false positives.

Significance. If the result holds, the framework is a meaningful step forward: it addresses a real gap in prior attribute-inference measures (ignoring recall), it produces a more accurate baseline by using un-anonymized data and better predictive models, and it ships as a usable, reproducible package with code and data. The empirical claim is crisp and falsifiable, and the paper is honest about the lack of an evidential basis for choosing thresholds. The main issue is that the headline 'correctly labeled' claim rests on hand-chosen parameters (alpha=3, R_min=0.0001, ALC threshold 0.5) that are not validated by a sensitivity analysis, and the PRC definition has a discontinuity at R=R_min that could flip classifications over tiny recall changes. These concerns do not invalidate the measurement framework, but they make the paper's central quantitative claim conditional rather than robust.

major comments (3)

[§4.1, Eq. (6)] The headline claim that over 25% of attacks are 'correctly labeled' as at risk depends on the specific choices alpha=3, R_min=0.0001, and the ALC threshold 0.5. Appendix A.2 explicitly states that 'there is no evidential basis on which to establish anonymity thresholds,' and Section 4.1 defends the PRC constants only through intuition and two examples. Figures 4b and 4c show that varying alpha or R_min materially changes the PRC equivalence curves, and since ALC is monotone in PRC, a different but plausible parameter choice could move a substantial fraction of the 8883 attacks across the ALC=0.5 line and change the 25% figure. The paper provides no sensitivity analysis over these parameters. Please report how the false-negative percentage in Table 2 varies over a plausible range of alpha (e.g., 1–5), R_min (e.g., 1e-5 to 1e-3), and ALC threshold (e.g., 0.3–0.7). Without this, the central empirical claim remains conditional on unvalidated choices.
[§4.1, Eq. (6)] Equation (6) has a discontinuity at R = R_min. For R just above R_min, the factor (1 - log10(R)/log10(R_min))^alpha tends to 0, so PRC tends to 0 regardless of precision; for R just below R_min, PRC = R, which is approximately R_min (0.0001). A small change in recall or in R_min can therefore jump PRC from near zero to a positive value, which can flip the ALC classification. The text in Section 4.1 says 'Below this value, PRC = R' but does not discuss this jump. Please either modify the definition to be continuous (e.g., a logistic blending function) or demonstrate empirically that no attack or baseline in the experiments has recall near R_min, so that the discontinuity does not affect the reported results.
[§4.2, §6.1, §5.1] The classification of an attack as 'safe' or 'at risk' is based on a point estimate of ALC (the maximum PRC difference), but the paper does not quantify the uncertainty of that ALC value. The halting criteria in Section 5.1 use confidence intervals to decide when to stop, yet the final ALC is computed from point estimates of PRC (the midpoint of the Wilson interval), and the reported labels in Table 2 are not accompanied by interval bounds. Attacks whose ALC falls just below 0.5 could be mislabeled 'safe' due to measurement error. Please report the distribution of ALC values near the 0.5 and 0.75 thresholds (e.g., a histogram or the fraction of attacks within 0.05 of each threshold), and consider classifying with interval bounds (e.g., flag only if the lower bound exceeds the threshold) to make the qualitative claims robust.

minor comments (6)

[§3.7] In the sentence 'dependent records don’t unduly effect the measure,' 'effect' should be 'affect.'
[§6.2] The sentence 'This is shows in Table 2' contains a typo; it should read 'This is shown in Table 2.'
[§4.1, Appendix A.2] The notation for the recall floor is inconsistent: Section 4.1 uses R_min, while Appendix A.2 uses C_min. Please unify.
[References and text] Reference [24] (Giomi et al.) is dated 2023 in the bibliography but the text cites it as 2022 in several places (e.g., Section 2 and Section 6). Please make the year consistent.
[Figure 7c] The x-axis label 'Value (weak anon)' and the many abbreviations in the legend make the figure hard to parse; please expand the labels and provide a short caption explaining what each panel shows.
[Table 1] The source 'SDNIST' for national2019 is ambiguous; spell out that it comes from the NIST SDNIST synthetic data project and consider adding a URL in the table caption.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: PRC/ALC are a priori definitions and the 25% figure is a measured disagreement between two measures, not an identity with the paper's inputs.

full rationale

The paper's derivation chain is empirical: run an attack and a baseline, compute precision and recall, combine them through PRC (Eq. 6), compute ALC (Eq. 8), and compare labels with a fixed threshold. PRC and ALC are definitions rather than results derived from the attack data; the constants alpha=3, Rmin=0.0001, and the ALC=0.5 threshold are chosen a priori and are explicitly acknowledged in Appendix A.2 as lacking an evidential basis. That acknowledgment is a validity and robustness limitation, not a circularity: the reported 'over 25%' is a factual statement about the fraction of attacks for which ALC_ours>0.5 while ALC_prior<0.5, and it would not change simply by restating the definition of ALC. No fitted parameter is later renamed as a prediction, and no load-bearing uniqueness theorem or prior result by the authors is invoked to force the conclusion. The self-citation to Francis (2022) is historical context about the US Census reconstruction attack and is not load-bearing for the new measure. The paper is self-contained in the sense that the experimental comparison is run against external datasets and the prior approach is implemented independently. Therefore, no significant circularity is present.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The measure introduces two hand-set parameters in the PRC formula and a suggested ALC threshold, all without empirical grounding. The baseline model assumes an attacker with access to original-data statistics, a modeling choice that changes the measure's meaning. The experiments assume random swapping is a representative anonymization and select attackable attribute combinations.

free parameters (3)

alpha (PRC sharpness) = 3.0
Chosen by hand to control how quickly the effect of recall declines; no principled derivation or sensitivity analysis.
R_min (recall threshold) = 0.0001
Threshold below which PRC equals recall; called conservative but chosen without empirical grounding.
ALC safe threshold = 0.5
Suggested conservative threshold for distinguishing safe from at risk; Appendix A.2 admits no evidential basis exists.

assumptions (4)

domain assumption Non-members of a dataset cannot have their privacy violated by the dataset's release, assuming independence from members.
Stated in Section 1 as a core principle behind differential privacy and used to justify the baseline approach.
domain assumption The baseline should model an attacker with access to the original data minus the target.
Defined in Section 3.4 and defended in Appendix A.1; this is a modeling choice, not a proven fact.
ad hoc to paper Precision should dominate recall except at very low recall values.
Justifies the PRC formula in Section 4.1; no empirical evidence is presented for this tradeoff.
domain assumption Random swapping of values within columns is a meaningful anonymization technique for evaluating the measure.
Used in Section 6 to generate anonymized datasets; not representative of differential privacy or k-anonymity.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Towards Better Attribute Inference Vulnerability Measures." pith.science (2026). https://pith.science/paper/AXOEHZQW

@misc{pith2026250701710,
  author       = {Pith},
  title        = {Pith review of: Towards Better Attribute Inference Vulnerability Measures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AXOEHZQW}},
  note         = {Machine review of arXiv:2507.01710}
}

read the original abstract

The purpose of anonymizing structured data is to protect the privacy of individuals in the data while retaining the statistical properties of the data. An important class of attack on anonymized data is attribute inference, where an attacker infers the value of an unknown attribute of a target individual given knowledge of one or more known attributes. A major limitation of recent attribute inference measures is that they do not take recall into account, only precision. It is often the case that attacks target only a fraction of individuals, for instance data outliers. Incorporating recall, however, substantially complicates the measure, because one must determine how to combine recall and precision in a composite measure for both the attack and baseline. This paper presents the design and implementation of an attribute inference measure that incorporates both precision and recall. Our design also improves on how the baseline attribute inference is computed. In experiments using a generic best row match attack on moderately-anonymized microdata, we show that in over 25\% of the attacks, our approach correctly labeled the attack to be at risk while the prior approach incorrectly labeled the attack to be safe.

Figures

Figures reproduced from arXiv: 2507.01710 by the authors.

**Figure 2.** Our approach to computing an attribute inference [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Example of how dependent records can affect the [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: PRC behavior where 𝑅𝑚𝑖𝑛 and 𝛼 are constants that allow a data custodian to control the effect of 𝑅 on PRC. The constant 𝛼 determines how quickly the effect of 𝑅 decreases as it approaches 𝑅𝑚𝑖𝑛. The constant 𝑅𝑚𝑖𝑛 is a threshold below which 𝑃 has no effect on PRC. Below …

**Figure 5.** Figure 5: Curves of equivalent ALC for different values of [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 7.** Figure 7: Comparison of our approach with prior approaches. The colorbar represents the attack recall values for attacks with [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

**Figure 8.** Figure 8: The effect of 𝛽 in the 𝐹𝛽 function [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 39 canonical work pages

[1]

John Abowd. 2019. Staring Down the Database Reconstruction Theorem. https: //www2.census.gov/programs-surveys/decennial/2020/resources/presentatio ns-publications/2019-02-16-abowd-db-reconstruction.pdf

work page 2019
[2]

John Abowd. 2021. Declaration of John Abowd. https://s3.documentcloud.org /documents/20615062/state-of-alabama-differential-privacy-april-13-2021- declaration-of-john-abowd.pdf

work page arXiv 2021
[3]

John M Abowd, Tamara Adams, Robert Ashmead, David Darais, Sourya Dey, Simson L Garfinkel, Nathan Goldschlag, Daniel Kifer, Philip Leclerc, Ethan Lew, et al. 2023. The 2010 Census Confidentiality Protections Failed, Here’s How and Why. arXiv preprint arXiv:2312.11283 (2023)

work page Pith review arXiv 2023
[4]

Micah Altman, Aloni Cohen, Kobbi Nissim, and Alexandra Wood. 2021. What a hybrid legal-technical analysis teaches us about privacy regulation: The case of singling out. BUJ Sci. & Tech. L. 27 (2021), 1

work page 2021
[5]

Aloni Cohen. 2022. Attacks on Deidentification’s Defenses. In 31st USENIX Security Symposium (USENIX Security 22) . 1469–1486

work page 2022
[6]

Tore Dalenius. 1977. Towards a methodology for statistical disclosure control. (1977)

work page 1977
[7]

Dorothy E Denning. 1980. Secure statistical databases with random sample queries. ACM Transactions on Database Systems (TODS) 5, 3 (1980), 291–315

work page 1980
[8]

Dorothy E Denning, Peter J Denning, and Mayer D Schwartz. 1979. The tracker: A threat to statistical database security. ACM Transactions on Database Systems (TODS) 4, 1 (1979), 76–96

work page 1979

Show all 44 references

[9]

Damien Desfontaines and Balázs Pejó. 2020. SoK: Differential privacies. Proceed- ings on Privacy Enhancing Technologies (2020)

2020
[10]

Irit Dinur and Kobbi Nissim. 2003. Revealing information while preserving privacy. In Proceedings of the twenty-second ACM SIGMOD-SIGACT-SIGART sym- posium on Principles of database systems . ACM, 202–210

2003
[11]

Cynthia Dwork. 2006. Differential Privacy. In ICALP

2006
[12]

Cynthia Dwork, Nitin Kohli, and Deirdre Mulligan. 2019. Differential privacy in practice: Expose your epsilons! Journal of Privacy and Confidentiality 9, 2 (2019)

2019
[13]

Cynthia Dwork, Adam Smith, Thomas Steinke, and Jonathan Ullman. 2017. Exposed! a survey of attacks on private data. Annual Review of Statistics and Its Application 4 (2017), 61–84

2017
[14]

Khaled El Emam, Lucy Mosquera, and Jason Bass. 2020. Evaluating identity disclosure risk in fully synthetic health data: model development and validation. Journal of medical Internet research 22, 11 (2020), e23139

2020
[15]

Mark Elliot. 2015. Final report on the disclosure risk associated with the synthetic data produced by the sylls team. Report 2015 2 (2015)

2015
[16]

Marc N Elliott, Peter A Morrison, Allen Fremont, Daniel F McCaffrey, Philip Pantoja, and Nicole Lurie. 2009. Using the Census Bureau’s surname list to improve estimates of race/ethnicity and associated disparities. Health Services and Outcomes Research Methodology 9 (2009), 69–83

2009
[17]

IP Fellegi and JJ Phillips. 1974. Statistical confidentiality: Some theory and application to data dissemination. In Annals of Economic and Social Measurement, Volume 3, number 2. NBER, 399–409

1974
[18]

Alvaro Figueira and Bruno Vaz. 2022. Survey on synthetic data generation, evaluation methods and GANs. Mathematics 10, 15 (2022), 2733

2022
[19]

Paul Francis. 2022. A Note on the Misinterpretation of the US Census Re-identification Attack. In International Conference on Privacy in Statistical Databases. Springer, 299–311. https://arxiv.org/abs/2202.04872

2022 arXiv
[20]

Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in pharmacogenetics: An {End-to-End} case study of personalized warfarin dosing. In 23rd USENIX security symposium (USENIX Security 14). 17–32

2014
[21]

Roland G Fryer Jr and Steven D Levitt. 2003. The causes and consequences of distinctively black names

2003
[22]

Truly Anonymous Syn- thetic Data

Georgi Ganev and Emiliano De Cristofaro. 2023. On the Inadequacy of Similarity- based Privacy Metrics: Reconstruction Attacks against "Truly Anonymous Syn- thetic Data". arXiv preprint arXiv:2312.05114 (2023)

2023 arXiv
[23]

Johannes Gehrke, Edward Lui, and Rafael Pass. 2011. Towards privacy for social networks: A zero-knowledge based definition of privacy. In Theory of cryptography conference. Springer, 432–449

2011
[24]

Matteo Giomi, Franziska Boenisch, Christoph Wehmeyer, and Borbála Tasnádi
[25]

John C Gower. 1971. A general coefficient of similarity and some of its properties. Biometrics (1971), 857–871

1971
[26]

Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR) 54, 11s (2022), 1–37

2022
[27]

Matthew Jagielski, Jonathan Ullman, and Alina Oprea. 2020. Auditing differen- tially private machine learning: How private is private sgd? Advances in Neural Information Processing Systems 33 (2020), 22205–22216

2020
[28]

Ali Kassem, Gergely Acs, Claude Castelluccia, and Catuscia Palamidessi. 2019. Differential inference testing: A practical approach to evaluate sanitizations of datasets. In 2019 IEEE Security and Privacy Workshops (SPW) . IEEE, 72–79

2019
[29]

Daniel Kifer, John M Abowd, Robert Ashmead, Ryan Cumings-Menon, Philip Leclerc, Ashwin Machanavajjhala, William Sexton, and Pavel Zhuravlev. 2022. Bayesian and frequentist semantics for common variations of differential privacy: Applications to the 2020 census. arXiv preprint ...

2022 arXiv
[30]

Bo Liu, Wanlei Zhou, Tianqing Zhu, Longxiang Gao, and Yong Xiang. 2018. Location privacy and its applications: A systematic study. IEEE access 6 (2018), 17606–17624

2018
[31]

Ashwin Machanavajjhala, Daniel Kifer, Johannes Gehrke, and Muthuramakrish- nan Venkitasubramaniam. 2007. l-diversity: Privacy beyond k-anonymity. ACM Transactions on Knowledge Discovery from Data (TKDD) 1, 1 (2007), 3–es

2007
[32]

Matthews and Ofer Harel

Gregory J. Matthews and Ofer Harel. 2011. Data confidentiality: A review of methods for statistical disclosure limitation and methods for assessing privacy. Statistics Surveys 5 (2011), 1–29. https://doi.org/10.1214/11-SS074

2011 doi
[33]

Arvind Narayanan and Vitaly Shmatikov. 2008. Robust de-anonymization of large sparse datasets. In 2008 IEEE Symposium on Security and Privacy (sp 2008) . IEEE, 111–125

2008
[34]

Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. 2021. Adversary instantiation: Lower bounds for differentially private machine learning. 2021 IEEE Symposium on security and privacy (SP) (2021), 866–882

2021
[35]

Article 29 Data Protection Working Party. 2014. Opinion 05/2014 on Anonymisa- tion Techniques. https://ec.europa.eu/justice/article-29/documentation/opinion- recommendation/files/2014/wp216_en.pdf

2014
[36]

Steven Ruggles and David Van Riper. 2021. The Role of Chance in the Census Bureau Database Reconstruction Experiment. Population Research and Policy Review (2021). https://doi.org/10.1007/s11113-021-09674-3

2021 doi
[37]

Natalie Shlomo, Caroline Tudor, and Paul Groom. 2010. Data Swapping for Pro- tecting Census Tables. In Privacy in Statistical Databases , Josep Domingo-Ferrer and Emmanouil Magkos (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 41–51

2010
[38]

Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 3–18

2017
[39]

Keith Spicer and Caroline Tudor. 2009. Balancing Risk and Utility–Statistical Disclosure Control for the 2011 UK Census. Joint UNECE/Eurostat work session on statistical data confidentiality, Bilbao 2, 4 (2009)

2009
[40]

Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. 2022. Synthetic data– anonymisation groundhog day. In 31st USENIX Security Symposium (USENIX Security 22). 1451–1468

2022
[41]

Thomas Steinke, Milad Nasr, and Matthew Jagielski. 2023. Privacy auditing with one (1) training run. Advances in Neural Information Processing Systems 36 (2023), 49268–49280

2023
[42]

Isabel Wagner and David Eckhoff. 2018. Technical privacy metrics: a systematic survey. ACM Computing Surveys (Csur) 51, 3 (2018), 1–38

2018
[43]

black hat

Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 268–282. Francis et al. A Discussion In this section, we dis...

2018
[2023]

Proceedings on Privacy Enhanced Technologies Symposium PoPETs (2023)

A Unified Framework for Quantifying Privacy Risk in Synthetic Data. Proceedings on Privacy Enhanced Technologies Symposium PoPETs (2023)

2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

John Abowd. 2019. Staring Down the Database Reconstruction Theorem. https: //www2.census.gov/programs-surveys/decennial/2020/resources/presentatio ns-publications/2019-02-16-abowd-db-reconstruction.pdf

work page 2019

[2] [2]

John Abowd. 2021. Declaration of John Abowd. https://s3.documentcloud.org /documents/20615062/state-of-alabama-differential-privacy-april-13-2021- declaration-of-john-abowd.pdf

work page arXiv 2021

[3] [3]

John M Abowd, Tamara Adams, Robert Ashmead, David Darais, Sourya Dey, Simson L Garfinkel, Nathan Goldschlag, Daniel Kifer, Philip Leclerc, Ethan Lew, et al. 2023. The 2010 Census Confidentiality Protections Failed, Here’s How and Why. arXiv preprint arXiv:2312.11283 (2023)

work page Pith review arXiv 2023

[4] [4]

Micah Altman, Aloni Cohen, Kobbi Nissim, and Alexandra Wood. 2021. What a hybrid legal-technical analysis teaches us about privacy regulation: The case of singling out. BUJ Sci. & Tech. L. 27 (2021), 1

work page 2021

[5] [5]

Aloni Cohen. 2022. Attacks on Deidentification’s Defenses. In 31st USENIX Security Symposium (USENIX Security 22) . 1469–1486

work page 2022

[6] [6]

Tore Dalenius. 1977. Towards a methodology for statistical disclosure control. (1977)

work page 1977

[7] [7]

Dorothy E Denning. 1980. Secure statistical databases with random sample queries. ACM Transactions on Database Systems (TODS) 5, 3 (1980), 291–315

work page 1980

[8] [8]

Dorothy E Denning, Peter J Denning, and Mayer D Schwartz. 1979. The tracker: A threat to statistical database security. ACM Transactions on Database Systems (TODS) 4, 1 (1979), 76–96

work page 1979