You Are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviors

By Neil Zhenqiang Gong, Bin Liu. 2016

157 citations recorded by the source corpus.

We propose new privacy attacks to infer attributes (e.g., locations, occupations, and interests) of online social network users. Our attacks leverage seemingly innocent user information that is publicly available in online social networks to infer missing attributes of targeted users. Given the increasing availability of (seemingly innocent) user information online, our results have serious implications for Internet privacy -- private attributes can be inferred from users' publicly available data unless we take steps to protect users from such inference attacks. To infer attributes of a targeted user, existing inference attacks leverage either the user's publicly available social friends or the user's behavioral records (e.g., the webpages that the user has liked on Facebook, the apps that the user has reviewed on Google Play), but not both. As we will show, such inference attacks achieve limited success rates. However, the problem becomes qualitatively different if we consider both social friends and behavioral records. To address this challenge, we develop a novel model to integrate social friends and behavioral records and design new attacks based on our model. We theoretically and experimentally demonstrate the effectiveness of our attacks. For instance, we observe that, in a real-world large-scale dataset with 1.1 million users, our attack can correctly infer the cities a user lived in for 57% of the users, via confidence estimation, we are able to increase the attack success rate to over 90% if the attacker selectively attacks a half of the users. Moreover, we show that our attack can correctly infer attributes for significantly more users than previous attacks.

Subfields: Artificial Intelligence, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Neil Zhenqiang Gong
2. Binghui Wang
3. Jinyuan Jia
4. Yang Zhang
5. Michael Backes
6. Ahmed Salem
7. Le Zhang
8. Chao Du

In Information Systems

1. Neil Zhenqiang Gong
2. Binghui Wang
3. Jinyuan Jia
4. Le Zhang
5. Chao Du
6. Michael Backes
7. Yang Zhang
8. Yan Huang

Citations in the corpus

• Attacking Graph-based Classification via Manipulating the Graph Structure (2019, critical): “Moreover, they were also used as privacy attacks to infer private attributes of social network users [24,25,35].”
• Poisoning Attacks to Graph-Based Recommender Systems (2018, neutral): “called aribute inference aacks [9] and have been demonstrated to be feasible by multiple studies [9–11, 16, 18, 33].”
• Attribute Inference Attacks in Online Social Networks (2018, methodology): “Attribute inference using social structure and behavior could also be solved by a social recommender system (e.g., Reference [62]).”
• AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning (2018, methodology): “The LR classifier was also used by previous attribute inference attacks [3, 5, 6, 9].”
• MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples (2019, background): “, attribute inference attacks [11, 17, 28], website fingerprinting attacks [7, 22, 29, 46, 67], side-channel attacks [73], location attacks [5, 45, 52, 72], and author identification attacks [8, 41].”
• Bag of Tricks for Training Data Extraction from Language Models (2023, background): “The objective of attribute inference attacks is to extract specific personal attributes such as locations, occupations, and interests from the model (Fredrikson et al., 2015; Gong & Liu, 2016; Ganju et al., 2018; Parisot et al., 2021).”
• Graph-based Security and Privacy Analytics via Collective Classification with Joint Weight Learning and Propagation (2018, background): “RW-N [13], [14], [26]–[28], [34] leverages labeled negative nodes to assign prior reputation scores, e.g., every labeled negative node in the training dataset has a prior reputation score of -1 (the absolute value of the reputation score does not matter since these RW-based methods rely on relative…”
• Random Walk Based Fake Account Detection in Online Social Networks (2017, background): “We note that our label-augmented social network can also be viewed as a Social-Attribute Network [37] or Social-BehaviorAttribute network [38], where the two label nodes are treated as attributes.”
• AttriInfer: Inferring User Attributes in Online Social Networks Using Markov Random Fields (2017, methodology): “VIAL [12] does not learn the prior probabilities.”