pith. sign in

arxiv: 2606.26021 · v1 · pith:L3Q6CLFEnew · submitted 2026-06-24 · 💻 cs.CR · cs.AI

Privacy Vulnerabilities of Attention Layers in Tabular Foundation Models and Protection of High-Risk Queries

T\^ania Carvalho , Maxime Cordy This is my paper

Pith reviewed 2026-06-25 19:34 UTC · model grok-4.3

classification 💻 cs.CR cs.AI
keywords membership inference attacktabular foundation modelsattention mechanismin-context learningprivacy defensek-anonymityfine-tuning risk
0
0 comments X

The pith

Attention patterns in tabular foundation models leak enough information for effective membership inference attacks on context examples.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Tabular foundation models are often seen as low-risk for privacy because they are pre-trained on synthetic data, yet they allow sensitive records to be supplied directly as context during inference. The paper demonstrates that the attention mechanism concentrates in ways that reveal whether a record was part of that context, enabling a shadow-model-free attack called AMIA that beats standard confidence-based attacks by an average of 7.7 percent, especially at low false-positive rates. To counter this, the authors introduce an inference-time defense that reduces the uniqueness of high-risk context-key representations without adding noise or retraining, cutting leakage from the new attack by about 50 percent and from confidence attacks by 25 percent while losing only 3.9 percent predictive performance. The work also shows that fine-tuning can increase vulnerability, as samples whose confidence rises afterward become easier to attack.

Core claim

Predictions generated via the attention mechanism in tabular foundation models leak sufficient information to enable effective Membership Inference Attacks. AMIA exploits the concentration of transformer attention patterns to achieve an average gain of 7.7 percent over classical confidence-based attacks, particularly in low false-positive regimes. An inference-time defense inspired by k-anonymity principles, applied only to high-risk queries identified by AMIA scores, reduces membership leakage by an average of 50 percent against the new attack and 25 percent against confidence-based attacks while preserving predictive utility with only 3.9 percent degradation. Fine-tuning introduces an addi

What carries the argument

AMIA scores derived from the concentration of attention patterns on context-key representations, used both to mount the attack and to select queries for the k-anonymity-style defense.

If this is right

  • Attention-based attacks outperform confidence-based ones by 7.7 percent on average and are strongest in low false-positive regimes.
  • Targeting only high-risk queries with an inference-time k-anonymity defense cuts leakage from AMIA by 50 percent and from confidence attacks by 25 percent.
  • The defense preserves predictive utility with only 3.9 percent average degradation and requires no retraining or noise injection.
  • Fine-tuning amplifies memorization, making samples with increased post-fine-tuning confidence more vulnerable to membership inference.
  • Context examples supplied at inference time constitute a distinct privacy surface beyond the pre-training data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same attention leakage could appear in other transformer-based in-context learners outside tabular data if context keys are similarly exposed.
  • A defense that only protects high-risk queries may leave an attacker who can force many queries into the system with a residual attack surface.
  • If attention concentration is the dominant signal, then architectures that dilute or regularize attention over context might reduce the need for query-level defenses.

Load-bearing premise

Attention patterns concentrate in ways that reliably encode membership signals for context examples even when other model factors vary.

What would settle it

Measure whether randomizing or masking attention weights on context examples drops AMIA success rate to the level of random guessing on the same queries.

Figures

Figures reproduced from arXiv: 2606.26021 by Maxime Cordy, T\^ania Carvalho.

Figure 1
Figure 1. Figure 1: Overview of the proposed attention membership inference attack (AMIA) and defence for the high-risk queries. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: depicts the TPR at low FPR for both attacks. We observe that AMIA consistently outperforms RMIA across all models and both datasets. In particular, the attention-based signal yields substantially stronger MIA performance than the output-based signal used by RMIA, indicating that attention weights expose membership infor￾mation that is not captured by prediction probabilities alone. For TabPFN and Real-TabP… view at source ↗
Figure 3
Figure 3. Figure 3: AMIA-based high-risk selection. The density plots show the full distribution of AMIA row-attention scores for all [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Privacy-utility trade-off of targeted label [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Fine-tuning membership signal in TabDPT using [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Comparison of MIAs across classical machine [PITH_FULL_IMAGE:figures/full_fig_p016_6.png] view at source ↗
Figure 9
Figure 9. Figure 9: Attack effectiveness and runtime for AMIA and [PITH_FULL_IMAGE:figures/full_fig_p017_9.png] view at source ↗
Figure 7
Figure 7. Figure 7: Per-layer AMIA AUC for TabPFN, TabICL and [PITH_FULL_IMAGE:figures/full_fig_p017_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Comparison of AMIA with offline and online [PITH_FULL_IMAGE:figures/full_fig_p017_8.png] view at source ↗
Figure 10
Figure 10. Figure 10: Evolution of membership inference attack risk as the context size increases. Context sizes corresponds to subsets [PITH_FULL_IMAGE:figures/full_fig_p018_10.png] view at source ↗
Figure 12
Figure 12. Figure 12: Fine-tuning utility and RMIA effectiveness. [PITH_FULL_IMAGE:figures/full_fig_p018_12.png] view at source ↗
read the original abstract

Tabular foundation models are commonly assumed to present limited privacy concerns as they are often pre-trained on large collections of synthetic data. However, these models leverage in-context learning, where sensitive records may be provided directly at inference time as labelled context examples. In this paper, we demonstrate that predictions generated via the attention mechanism leak sufficient information to enable effective Membership Inference Attacks (MIAs). To highlight this vulnerability, we propose AMIA (Attention-based Membership Inference Attack), a shadow-model-free attack that exploits the concentration of transformer attention patterns. Our results show that attention mechanisms reveal strong membership signals, which exceed classical confidence-based attacks, achieving an average gain of 7.7\%, specially in low false-positive regimes. To mitigate this risk, we introduce an inference-time defence inspired by $k$-anonymity principles. This approach reduces the uniqueness of context-key representations without introducing random noise or retraining the model. By targeting only high-risk queries identified through AMIA scores, the defence substantially reduces membership leakage of this attack by an average of 50\% and 25\% against confidence-based attacks, while preserving predictive utility with only 3.9\% performance degradation. Beyond showing that context examples are vulnerable, we further demonstrate that fine-tuning introduces an additional source of privacy risk. In particular, samples whose prediction confidence increases after fine-tuning become more susceptible to MIAs, indicating that fine-tuning can amplify memorisation and expose sensitive training information through confidence shifts.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 2 minor

Summary. The paper claims that attention patterns in tabular foundation models enable effective shadow-model-free membership inference attacks (AMIA) via concentration signals, yielding a 7.7% average gain over confidence-based attacks (especially at low FPR). It further claims that an inference-time k-anonymity-style defense, applied only to high-risk queries identified by AMIA scores, reduces leakage by 50% (vs. AMIA) and 25% (vs. confidence attacks) at a cost of 3.9% predictive utility, and that fine-tuning amplifies memorization as measured by post-fine-tuning confidence increases.

Significance. If the attention-based signal proves independent of query-context similarity and other confounders, the work would identify a previously under-appreciated privacy vector in in-context tabular models and supply a lightweight, model-agnostic mitigation; the shadow-model-free nature and targeted defense would be notable strengths.

major comments (3)
  1. [§4] §4 (AMIA construction): the claim that attention concentration encodes membership independently of other factors is load-bearing for the 7.7% gain result, yet no ablation is described that matches context examples to queries on cosine similarity (or label balance); if the gain vanishes under such matching, the reported leakage would be an artifact of sampling rather than an inherent attention vulnerability.
  2. [Abstract, §5] Abstract and §5 (defense evaluation): the 50% and 25% leakage reductions and 3.9% utility degradation are reported without error bars, number of runs, or statistical tests; because the defense is applied selectively via AMIA scores, any confounding in the AMIA signal directly undermines the defense efficacy claims.
  3. [fine-tuning paragraph] Fine-tuning experiment (final paragraph): the claim that samples with increased post-fine-tuning confidence become more susceptible to MIAs requires explicit controls for overall model calibration shift; without them the observed confidence change could be a global effect rather than evidence of amplified memorization.
minor comments (2)
  1. Notation for attention scores and AMIA threshold should be defined once in a dedicated subsection rather than introduced piecemeal.
  2. Table or figure captions for the quantitative results should explicitly list the datasets, model sizes, and number of trials used to obtain the reported percentages.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive feedback. We address each major comment below and outline revisions where the manuscript requires strengthening.

read point-by-point responses

  1. Referee: [§4] §4 (AMIA construction): the claim that attention concentration encodes membership independently of other factors is load-bearing for the 7.7% gain result, yet no ablation is described that matches context examples to queries on cosine similarity (or label balance); if the gain vanishes under such matching, the reported leakage would be an artifact of sampling rather than an inherent attention vulnerability.

    Authors: We agree that an explicit ablation controlling for cosine similarity between queries and context examples, as well as label balance, is necessary to substantiate that the attention concentration signal operates independently of these factors. The current experiments rely on random sampling, which leaves open the possibility of confounding. We will add this ablation in the revised manuscript by constructing matched query-context pairs and re-evaluating AMIA performance; if the gain persists, it will be reported with the original results for comparison. revision: yes

  2. Referee: [Abstract, §5] Abstract and §5 (defense evaluation): the 50% and 25% leakage reductions and 3.9% utility degradation are reported without error bars, number of runs, or statistical tests; because the defense is applied selectively via AMIA scores, any confounding in the AMIA signal directly undermines the defense efficacy claims.

    Authors: The referee correctly notes the absence of error bars, run counts, and statistical tests in the defense results. Because the defense is conditioned on AMIA scores, robustness of those scores is critical. We will rerun all defense experiments across multiple random seeds (minimum five runs), report means with standard deviations, and include statistical comparisons (e.g., paired t-tests) between defended and undefended settings in the revised §5 and abstract. revision: yes

  3. Referee: [fine-tuning paragraph] Fine-tuning experiment (final paragraph): the claim that samples with increased post-fine-tuning confidence become more susceptible to MIAs requires explicit controls for overall model calibration shift; without them the observed confidence change could be a global effect rather than evidence of amplified memorization.

    Authors: We acknowledge that without controls for global calibration shifts, the observed post-fine-tuning confidence increases could reflect a model-wide effect rather than targeted memorization. We will add explicit controls in the revision, such as comparing confidence changes on a held-out non-fine-tuned set and normalizing per-sample confidence deltas against the overall distribution shift, before correlating with MIA success rates. revision: yes

Circularity Check

0 steps flagged

No circularity in derivation chain

full rationale

The paper presents an empirical attack (AMIA) and defense without any mathematical derivations, equations, or parameter fittings that reduce to inputs by construction. The attack is explicitly shadow-model-free and relies on observed attention concentration patterns as an independent signal. No self-citations, uniqueness theorems, or ansatzes are invoked to justify core claims in the abstract or description. The central results are presented as experimental measurements rather than derived predictions, making the work self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract contains no mathematical derivations, fitted parameters, or postulated entities; full paper required to populate ledger.

pith-pipeline@v0.9.1-grok · 5794 in / 1190 out tokens · 28714 ms · 2026-06-25T19:34:49.946935+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

51 extracted references · 16 canonical work pages · 4 internal anchors

  1. [1]

    Sur- vey on privacy-preserving techniques for microdata publication,

    T. Carvalho, N. Moniz, P. Faria, and L. Antunes, “Sur- vey on privacy-preserving techniques for microdata publication,”ACM Computing Surveys, vol. 55, no. 14s, pp. 1–42, 2023

    2023

  2. [2]

    Membership inference attacks on machine learning: A survey,

    H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang, “Membership inference attacks on machine learning: A survey,”ACM Computing Surveys (CSUR), vol. 54, no. 11s, pp. 1–37, 2022

    2022

  3. [3]

    Tabarena: A liv- ing benchmark for machine learning on tabular data,

    N. Erickson, L. Purucker, A. Tschalzev, D. Holzm ¨uller, P. Desai, D. Salinas, and F. Hutter, “Tabarena: A liv- ing benchmark for machine learning on tabular data,” Advances in Neural Information Processing Systems, vol. 38, 2026

    2026

  4. [4]

    Language models are few-shot learners,

    T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Ka- plan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sas- try, A. Askellet al., “Language models are few-shot learners,”Advances in neural information processing systems, vol. 33, pp. 1877–1901, 2020

    1901

  5. [5]

    What can transformers learn in-context? a case study of sim- ple function classes,

    S. Garg, D. Tsipras, P. S. Liang, and G. Valiant, “What can transformers learn in-context? a case study of sim- ple function classes,”Advances in neural information processing systems, vol. 35, pp. 30 583–30 598, 2022

    2022

  6. [6]

    Understanding emergent in-context learning from a kernel regression perspective,

    C. Han, Z. Wang, H. Zhao, and H. Ji, “Understanding emergent in-context learning from a kernel regression perspective,”Transactions on Machine Learning Re- search, 2025

    2025

  7. [7]

    The mechanistic basis of data dependence and abrupt learning in an in-context classification task,

    G. Reddy, “The mechanistic basis of data dependence and abrupt learning in an in-context classification task,” arXiv preprint arXiv:2312.03002, 2023

    work page arXiv 2023

  8. [8]

    In-context learning for extreme multi-label classification,

    K. D’Oosterlinck, O. Khattab, F. Remy, T. De- meester, C. Develder, and C. Potts, “In-context learning for extreme multi-label classification,”arXiv preprint arXiv:2401.12178, 2024

    work page arXiv 2024

  9. [9]

    TabPFN: A Transformer That Solves Small Tabular Classification Problems in a Second

    N. Hollmann, S. M ¨uller, K. Eggensperger, and F. Hut- ter, “TabPFN: A Transformer That Solves Small Tab- ular Classification Problems in a Second,” Sep. 2023, arXiv:2207.01848 [cs]

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  10. [10]

    TabPFN: Accurate predictions on small data with a tabular foundation model,

    N. Hollmann, S. M ¨uller, L. Purucker, A. Krishnaku- mar, M. K ¨orfer, S. B. Hoo, R. T. Schirrmeister, and F. Hutter, “TabPFN: Accurate predictions on small data with a tabular foundation model,”Nature, vol. 637, no. 8045, pp. 319–326, Jan. 2025

    2025

  11. [11]

    TabICL: A Tabular Foundation Model for In-Context Learning on Large Data

    J. Qu, D. Holzm ¨uller, G. Varoquaux, and M. L. Morvan, “TabICL: A Tabular Foundation Model for In-Context Learning on Large Data,” Feb. 2025, arXiv:2502.05564 [cs]

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  12. [12]

    Tabdpt: Scaling tabular foundation mod- els on real data,

    J. Ma, V . Thomas, R. Hosseinzadeh, A. Labach, J. Cresswell, K. Golestan, G. Yu, A. L. Caterini, and M. V olkovs, “Tabdpt: Scaling tabular foundation mod- els on real data,”Advances in Neural Information Pro- cessing Systems, vol. 38, pp. 172 692–172 722, 2026

    2026

  13. [13]

    Tabstar: A tabular foundation model for tabular data with text fields,

    A. Arazi, E. Shapira, and R. Reichart, “Tabstar: A tabular foundation model for tabular data with text fields,”Advances in Neural Information Processing Systems, vol. 38, pp. 172 108–172 161, 2026

    2026

  14. [14]

    Mitra: Mixed synthetic priors for enhancing tabular foundation models,

    X. Zhang, D. Maddix Robinson, J. Yin, N. Erickson, A. F. Ansari, B. Han, S. Zhang, L. Akoglu, C. Falout- sos, M. Mahoneyet al., “Mitra: Mixed synthetic priors for enhancing tabular foundation models,”Advances in neural information processing systems, vol. 38, pp. 15 795–15 840, 2026

    2026

  15. [15]

    Tabflex: Scaling tabular learning to millions with lin- ear attention,

    Y . Zeng, T. Dinh, W. Kang, and A. C. Mueller, “Tabflex: Scaling tabular learning to millions with lin- ear attention,”arXiv preprint arXiv:2506.05584, 2025

    work page arXiv 2025

  16. [16]

    Defenses to membership in- ference attacks: A survey,

    L. Hu, A. Yan, H. Yan, J. Li, T. Huang, Y . Zhang, C. Dong, and C. Yang, “Defenses to membership in- ference attacks: A survey,”ACM Computing Surveys, vol. 56, no. 4, pp. 1–34, 2023

    2023

  17. [17]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in2022 IEEE symposium on security and privacy (SP). IEEE, 2022, pp. 1897–1914

    2022

  18. [18]

    Low-cost high- power membership inference attacks,

    S. Zarifzadeh, P. Liu, and R. Shokri, “Low-cost high- power membership inference attacks,”arXiv preprint arXiv:2312.03262, 2023

    work page arXiv 2023

  19. [19]

    Enhanced membership inference at- tacks against machine learning models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “Enhanced membership inference at- tacks against machine learning models,” inProceed- ings of the 2022 ACM SIGSAC conference on computer and communications security, 2022, pp. 3093–3106

    2022

  20. [20]

    Membership inference attacks against machine learn- ing models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learn- ing models,” in2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18

    2017

  21. [21]

    On the privacy risk of in-context learn- ing,

    H. Duan, A. Dziedzic, M. Yaghini, N. Papernot, and F. Boenisch, “On the privacy risk of in-context learn- ing,”arXiv preprint arXiv:2411.10512, 2024

    work page arXiv 2024

  22. [22]

    Membership Inference Attacks Against In-Context Learning,

    R. Wen, Z. Li, M. Backes, and Y . Zhang, “Membership Inference Attacks Against In-Context Learning,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. Salt Lake City UT USA: ACM, Dec. 2024, pp. 3481–3495

    2024

  23. [23]

    Context-aware membership inference attacks against pre-trained large language models,

    H. Chang, A. S. Shamsabadi, K. Katevas, H. Haddadi, and R. Shokri, “Context-aware membership inference attacks against pre-trained large language models,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025, pp. 7299–7321

    2025

  24. [24]

    Lora-leak: Membership inference at- tacks against lora fine-tuned language models,

    D. Ran, X. He, T. Cong, A. Wang, Q. Li, and X. Wang, “Lora-leak: Membership inference at- tacks against lora fine-tuned language models,”arXiv preprint arXiv:2507.18302, 2025

    work page arXiv 2025

  25. [25]

    ContextLeak: Auditing Leakage in Private In-Context Learning Methods

    J. Choi, S. Cao, X. Dong, A. Banayeeanzade, W. B. Zhu, R. Jia, and S. P. Karimireddy, “Contextleak: Au- diting leakage in private in-context learning methods,” arXiv preprint arXiv:2512.16059, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  26. [26]

    Tab-mia: A benchmark dataset for mem- bership inference attacks on tabular data in llms,

    E. German, S. Antebi, D. Samira, A. Shabtai, and Y . Elovici, “Tab-mia: A benchmark dataset for mem- bership inference attacks on tabular data in llms,” ArXiv, vol. abs/2507.17259, 2025

    work page arXiv 2025

  27. [27]

    Differential privacy,

    C. Dwork, “Differential privacy,” inEncyclopedia of Cryptography, Security and Privacy. Springer, 2025, pp. 649–652

    2025

  28. [28]

    Privacy- preserving in-context learning for large language mod- els,

    T. Wu, A. Panda, J. T. Wang, and P. Mittal, “Privacy- preserving in-context learning for large language mod- els,” inInternational Conference on Learning Repre- sentations, vol. 2024, 2024, pp. 20 005–20 040

    2024

  29. [29]

    Locally differentially pri- vate in-context learning,

    C. Zheng, K. Sun, W. Zhao, H. Zhou, L. Jiang, S. Song, and C. Zhou, “Locally differentially pri- vate in-context learning,” inProceedings of the 2024 Joint International Conference on Computational Lin- guistics, Language Resources and Evaluation (LREC- COLING 2024), 2024, pp. 10 686–10 697

    2024

  30. [30]

    Pri- vate prediction for large-scale synthetic text genera- tion,

    K. Amin, A. Bie, W. Kong, A. Kurakin, N. Pono- mareva, U. Syed, A. Terzis, and S. Vassilvitskii, “Pri- vate prediction for large-scale synthetic text genera- tion,” inFindings of the Association for Computational Linguistics: EMNLP 2024, 2024, pp. 7244–7262

    2024

  31. [31]

    Privacy preserving in-context-learning framework for large lan- guage models,

    B. Bhusal, M. Acharya, R. Kaur, C. Samplawski, A. Roy, A. D. Cobb, R. Chadha, and S. Jha, “Privacy preserving in-context-learning framework for large lan- guage models,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 40, no. 42, 2026, pp. 35 303–35 312

    2026

  32. [32]

    Privacy- preserving in-context learning with differentially pri- vate few-shot generation,

    X. Tang, R. Shin, H. Inan, A. Manoel, N. Mireshghal- lah, Z. Lin, S. Gopi, J. Kulkarni, and R. Sim, “Privacy- preserving in-context learning with differentially pri- vate few-shot generation,” inInternational confer- ence on learning representations, vol. 2024, 2024, pp. 33 058–33 077

    2024

  33. [33]

    Differen- tially private in-context learning with nearest neighbor search,

    A. Koskela, T. D. Kulkarni, and L. Zumot, “Differen- tially private in-context learning with nearest neighbor search,”ArXiv, vol. abs/2511.04332, 2025

    work page arXiv 2025

  34. [34]

    Flocks of stochastic parrots: Differentially private prompt learning for large language models,

    H. Duan, A. Dziedzic, N. Papernot, and F. Boenisch, “Flocks of stochastic parrots: Differentially private prompt learning for large language models,”Advances in Neural Information Processing Systems, vol. 36, pp. 76 852–76 871, 2023

    2023

  35. [35]

    Dp- tabicl: In-context learning with differentially private tabular data,

    A. N. Carey, K. Bhaila, K. Edemacu, and X. Wu, “Dp- tabicl: In-context learning with differentially private tabular data,” in2024 IEEE International Conference on Big Data (BigData). IEEE, 2024, pp. 1552–1557

    2024

  36. [36]

    When Tables Leak: Attacking String Memorization in LLM-Based Tabular Data Generation

    J. Ward, B. Gu, C.-H. Wang, and G. Cheng, “When tables leak: Attacking string memorization in llm-based tabular data generation,”arXiv preprint arXiv:2512.08875, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  37. [37]

    Risk in context: Benchmarking privacy leakage of foundation models in synthetic tabular data generation,

    J. Byun, X. Lin, J. Ward, and G. Cheng, “Risk in context: Benchmarking privacy leakage of foundation models in synthetic tabular data generation,”arXiv preprint arXiv:2507.17066, 2025

    work page arXiv 2025

  38. [38]

    Attenmia: Llm membership infer- ence attack through attention signals,

    P. Zaree, M. A. A. Mamun, Y . Dong, I. Alouani, and N. Abu-Ghazaleh, “Attenmia: Llm membership infer- ence attack through attention signals,”arXiv preprint arXiv:2601.18110, 2026

    work page arXiv 2026

  39. [39]

    Tabnet: Attentive inter- pretable tabular learning,

    S. ¨O. Arik and T. Pfister, “Tabnet: Attentive inter- pretable tabular learning,” inProceedings of the AAAI conference on artificial intelligence, vol. 35, no. 8, 2021, pp. 6679–6687

    2021

  40. [40]

    Sok: Challenges in tabular membership inference attacks,

    C. P ˆera, T. Carvalho, M. Cordy, and L. Antunes, “Sok: Challenges in tabular membership inference attacks,” arXiv preprint arXiv:2601.15874, 2026

    work page arXiv 2026

  41. [41]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,”Advances in neural infor- mation processing systems, vol. 30, 2017

    2017

  42. [42]

    Overconfidence is a dangerous thing: Mitigating membership inference at- tacks by enforcing less confident prediction,

    Z. Chen and K. Pattabiraman, “Overconfidence is a dangerous thing: Mitigating membership inference at- tacks by enforcing less confident prediction,”arXiv preprint arXiv:2307.01610, 2023

    work page arXiv 2023

  43. [43]

    Demystifying membership inference attacks in ma- chine learning as a service,

    S. Truex, L. Liu, M. E. Gursoy, L. Yu, and W. Wei, “Demystifying membership inference attacks in ma- chine learning as a service,”IEEE transactions on services computing, vol. 14, no. 6, pp. 2073–2089, 2019

    2073

  44. [44]

    k-anonymity: A model for protecting privacy,

    L. Sweeney, “k-anonymity: A model for protecting privacy,”Int. J. Uncertain. Fuzziness Knowl. Based Syst., vol. 10, pp. 557–570, 2002

    2002

  45. [45]

    Practical data-oriented microaggregation for statistical disclo- sure control,

    J. Domingo-Ferrer and J. M. Mateo-Sanz, “Practical data-oriented microaggregation for statistical disclo- sure control,”IEEE Trans. Knowl. Data Eng., vol. 14, pp. 189–201, 2002

    2002

  46. [46]

    Purucker, “Mic,” OpenML, id=46943; Accessed May 2026

    L. Purucker, “Mic,” OpenML, id=46943; Accessed May 2026

    2026

  47. [47]

    Foursquare global-scale check-in dataset with user social networks,

    D. Y ANG, “Foursquare global-scale check-in dataset with user social networks,” accessed Jan 2026

    2026

  48. [48]

    Tabular- bench: Benchmarking adversarial robustness for tab- ular deep learning in real-world use-cases,

    T. Simonetto, S. Ghamizi, and M. Cordy, “Tabular- bench: Benchmarking adversarial robustness for tab- ular deep learning in real-world use-cases,”Advances in Neural Information Processing Systems, vol. 37, pp. 78 394–78 430, 2024

    2024

  49. [49]

    Predict Students’ Dropout and Academic Suc- cess,

    V . Realinho, M. V . Martins, J. Machado, and L. Bap- tista, “Predict Students’ Dropout and Academic Suc- cess,” UCI Machine Learning Repository, 2021, ac- cessed Jan 2026

    2021

  50. [50]

    Financial indicators us stocks,

    Y . Li, “Financial indicators us stocks,” OpenML, id=46567; Accessed May 2026

    2026

  51. [51]

    Acquire valued shoppers challenge,

    W. Cukierski, “Acquire valued shoppers challenge,” Kaggle, accessed Jan 2026. Appendix A. Datasets The characteristics of all datasets used to evaluate the MIAs are presented in Table 3. We use datasets that span a range of sample sizes, features, and class labels. The domains include healthcare, finance, education, locations and purchases. Datasetnsample...

    2026