Exposed! A Survey of Attacks on Private Data

By Cynthia Dwork, Adam D. Smith, Thomas Steinke, Jonathan Ullman. 2017

314 citations recorded by the source corpus.

Privacy-preserving statistical data analysis addresses the general question of protecting privacy when publicly releasing information about a sensitive dataset. A privacy attack takes seemingly innocuous released information and uses it to discern the private details of individuals, thus demonstrating that such information compromises privacy. For example, re-identification attacks have shown that it is easy to link supposedly de-identified records to the identity of the individual concerned. This survey focuses on attacking aggregate data, such as statistics about how many individuals have a certain disease, genetic trait, or combination thereof. We consider two types of attacks: reconstruction attacks, which approximately determine a sensitive feature of all the individuals covered by the dataset, and tracing attacks, which determine whether or not a target individual's data are included in the dataset. We also discuss techniques from the differential privacy literature for releasing approximate aggregate statistics while provably thwarting any privacy attack.

Subfields: Artificial Intelligence, Epidemiology, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Epidemiology

In Privacy & Security

Citations in the corpus

Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity (2018, background): “As a pragmatic means for reducing privacy risks, reports are typically anonymized and often aggregated in deployments of monitoring by careful operators (e.g., RAPPOR [EPK14])— even though anonymity is no privacy panacea [DSSU17, Dez18].”
Tight Lower Bounds for Differentially Private Selection (2017, background): “Relationship to Previous Lower Bounds and Attacks Our argument is closely related to the work on tracing attacks [29], [30], [16], [17], [18], [26], [31].”
Comprehensive Privacy Analysis of Deep Learning: Stand-alone and Federated Learning under Passive and Active White-box Inference Attacks (2018, background): “The inference attacks fall into two fundamental and related categories: tracing (a.k.a. membership inference) attacks, and reconstruction attacks [1].”
Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning (2018, neutral): “membership inference) attacks, and reconstruction attacks [1].”
Machine Learning with Membership Privacy using Adversarial Regularization (2018, background): “The membership inference attacks have mostly been studied for analyzing dataprivacy withrespecttosimple statisticallinear functions [5, 17, 18, 23, 42, 43].”
CoinPress: Practical Private Mean and Covariance Estimation (2020, unknown): “However, this solution is not suitable when the samples consist of sensitive, private information belonging to individuals, as it has been shown repeatedly that even releasing just the empirical mean can reveal this sensitive information [13, 23, 8, 18, 17].”
On the Privacy Risks of Model Explanations (2019, methodology): “For example-based explanations, our algorithms can reconstruct a large fraction of the training data (referred to as dataset reconstruction attacks [16]).”
The limits of pan privacy and shuffle privacy for learning and estimation (2020, background): “We refer the reader to [26] for a survey of these lower bounds.”
When is memorization of irrelevant training data necessary for high-accuracy learning? (2020, background): “There are also well established attacks on statistical and learning algorithms for high-dimensional problems (starting with [15]; see [18] for a survey of the theory, and a recent line of work on membership inference attacks [36] for empirical results).”
Privacy preservation in federated learning: An insightful survey from the GDPR perspective (2020, background): “intended features can be exploited to infer some information about the training data samples. FL systems, consequently, is vulnerable to inference attacks (i.e., membership and reconstruction attacks [89]). Furthermore, local nodes not only passively contribute local training results but also get up”
A Survey on Differential Privacy for Unstructured Data Content (2022, background): “[24] once studied the robustness of DP in thwarting re-identification attacks.”
Enhanced Membership Inference Attacks against Machine Learning Models (2021, background): “, 2020] are the main inference attacks that highlight, and can quantify, the privacy risk of releasing aggregate information computed on sensitive data [Dwork et al., 2017].”
Privately Learning High-Dimensional Distributions (2018, background): “…only the estimated parameters of a distribution may seem harmless, when there are enough parameters—that is, when the data is high-dimensional —these statistics can reveal a lot of individual-speciﬁc information (see e.g. [DN03, HSR + 08, BUV14, DSS + 15, SSSS17], and the survey [DSSU17]).”
Membership Inference Attacks From First Principles (2021, methodology): “First explored as tracing attacks [11, 12, 22, 59] on medical datasets, they were exended to machine learning models as membership inference attacks [60].”