Attribute Inference

The attack leverages latent correlations between non-sensitive model inputs and sensitive attributes. For example, a model predicting purchase history from zip code and browsing behavior may inadvertently encode income level or ethnicity in its internal representations. Attackers query the model with known public data and analyze the output distribution to infer the hidden sensitive attribute. This succeeds because the model acts as a statistical oracle, revealing conditional probabilities that should remain private.

Attribute inference typically requires only API-level access to the target model. The attacker submits carefully crafted inputs and observes the returned predictions or confidence scores. No access to model weights, gradients, or architecture is needed. This makes it a low-cost, high-impact attack vector against any publicly exposed machine learning endpoint. Defenses must assume the attacker can submit unlimited queries and analyze the full prediction vector.

Common targets include:

• Sensitive health conditions inferred from purchasing or browsing data
• Political affiliation derived from media consumption patterns
• Sexual orientation inferred from social network structure
• Religious beliefs deduced from location and temporal behavior patterns
• Genetic predispositions inferred from correlated lifestyle features

The attack is particularly dangerous because individuals may have explicitly withheld these attributes, yet the model reconstructs them from proxy signals.

The granularity of model outputs directly impacts attack success. A model returning full softmax probability vectors with high-precision floats leaks significantly more information than one returning only the top-1 class label. Attackers analyze subtle variations in confidence scores across different query inputs to triangulate sensitive attributes. Confidence score masking and prediction vector truncation are primary countermeasures that reduce this information channel.

Training with Differentially Private Stochastic Gradient Descent (DP-SGD) provides formal guarantees against attribute inference. By clipping per-sample gradients and injecting calibrated Gaussian noise during optimization, the model's outputs become statistically indistinguishable whether any individual's sensitive attribute was present in training. The privacy budget (ε) quantifies the maximum information leakage, with lower epsilon values providing stronger protection at the cost of model utility.

Attribute inference and membership inference are distinct but complementary attacks. Membership inference asks 'Was this record in the training set?' while attribute inference asks 'What is the hidden value of this attribute for a known individual?' A successful membership inference attack can serve as a precursor to attribute inference by confirming the target is in the training distribution, which increases the confidence of the inferred attribute value. Both exploit model overfitting to training data.