Attribute Inference Attack

The attack leverages spurious correlations learned by the model between quasi-identifiers (public) and sensitive attributes (private).

• Mechanism: An adversary uses known, non-sensitive features (e.g., zip code, age, browsing history) to predict a hidden sensitive attribute (e.g., income, health status, political affiliation).
• Example: A model trained on medical records may inadvertently learn that a specific combination of prescribed drugs (public) correlates highly with a specific genetic marker (private).
• Key Distinction: This differs from re-identification risk; the attacker doesn't need to know who the person is, only to infer a sensitive property about them.

Synthetic data is not immune. If a Generative Adversarial Network (GAN) or Variational Autoencoder (VAE) overfits, it memorizes the correlation structure of the real data.

• Synthetic Reconstruction: An attacker queries a synthetic dataset, identifies records similar to a target's public profile, and reads off the sensitive attribute.
• Model Output Attack: Querying a black-box API with partial user profiles and observing the confidence scores or generated completions to infer the missing attribute.
• Mitigation: Applying Differential Privacy (DP) during synthetic generation breaks these exact correlations by adding calibrated noise, directly addressing the privacy-utility trade-off.

These two privacy attacks are often confused but target fundamentally different secrets.

• Membership Inference: Binary classification. Was record x in the training set D_train? Exploits model overfitting and confidence score differences.
• Attribute Inference: Regression or multi-class classification. What is the value of hidden feature s for record x? Exploits feature correlation.
• Combined Attack: A sophisticated adversary can chain them: first confirm membership via a membership inference attack, then extract attributes with higher confidence, significantly increasing re-identification risk.

Defenses focus on breaking the correlation pathways between public inputs and private targets.

• Differential Privacy (DP-SGD): The gold standard. Clips and noises gradients during training to provide a mathematical guarantee against inference.
• Adversarial Training: Augments training with adversarial examples designed to fool an attribute inference classifier, forcing the model to learn decorrelated representations.
• Data Minimization: Simply removing quasi-identifiers or highly correlated public features before training.
• Output Perturbation: Adding noise to model predictions or synthetic data queries to reduce signal fidelity for the attacker.

Genomic datasets are a prime target due to high-dimensional, strongly correlated features.

• Scenario: A research lab releases a synthetic genomic dataset for GWAS (Genome-Wide Association Studies).
• Attack: An adversary uses publicly available demographic data (age, ethnicity) and a subset of non-sensitive SNPs to infer a target's status for a sensitive disease marker (e.g., APOE4 for Alzheimer's).
• Consequence: Violates Genetic Information Nondiscrimination Act (GINA) principles and erodes public trust in data-sharing initiatives.