Knock Knock, Who's There? Membership Inference on Aggregate Location Data

By Apostolos Pyrgelis, Carmela Troncoso, Emiliano De Cristofaro. 2017

296 citations recorded by the source corpus.

Aggregate location data is often used to support smart services and applications, e.g., generating live traffic maps or predicting visits to businesses. In this paper, we present the first study on the feasibility of membership inference attacks on aggregate location time-series. We introduce a game-based definition of the adversarial task, and cast it as a classification problem where machine learning can be used to distinguish whether or not a target user is part of the aggregates. We empirically evaluate the power of these attacks on both raw and differentially private aggregates using two mobility datasets. We find that membership inference is a serious privacy threat, and show how its effectiveness depends on the adversary's prior knowledge, the characteristics of the underlying location data, as well as the number of users and the timeframe on which aggregation is performed. Although differentially private mechanisms can indeed reduce the extent of the attacks, they also yield a significant loss in utility. Moreover, a strategic adversary mimicking the behavior of the defense mechanism can greatly limit the protection they provide. Overall, our work presents a novel methodology geared to evaluate membership inference on aggregate location data in real-world settings and can be used by providers to assess the quality of privacy protection before data release or by regulators to detect violations.

Subfields: Artificial Intelligence, Computer Science Applications, Sociology and Political Science, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Science Applications

In Sociology and Political Science

In Privacy & Security

Citations in the corpus

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “Specifically, an attacker could compromise the confidentiality of users’ private training or testing data via various attacks such as model inversion attacks [21, 22], membership inference attacks [40, 49, 53], and property inference attacks [1, 24].”
Exploiting Unintended Feature Leakage in Collaborative Learning (2018, background): “ggregated updates. Membership inference. Prior work demonstrated the feasibility of membership inference from aggregate statistics, e.g., in the context of genomic studies [3,27], location timeseries [50], or noisy statistics in general [14]. Membership inference against black-box ML models has also”
Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “…examples [7,12,27,30,37,40,43,46,51,53,56, 68], poisoning attacks [8,18,31,38,67,70], privacy attacks for users (e.g., model inversion attacks [19,20], membership inference attacks [49,52], property inference attacks [3,21]), as well as model parameter and hyperparameter stealing attacks [60,61].”
Stealing Hyperparameters in Machine Learning (2018, background): “Several studies [45], [48], [42] demonstrated even stronger attacks, i.e., an attacker can infer whether a particular instance was in the training dataset or not.”
Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks (2019, background): “Membership attacks [28, 15, 24, 14, 26] attempt to determine whether a particular cohort of data was used for training, without any constructive indication on how to actively forget it.”
Auditing Data Provenance in Text-Generation Models (2018, background): “Membership inference attacks against aggregate statistics have been demonstrated in the context of genomic studies [13], location time-series [26], and noisy statistics in general [8].”
LOGAN: Membership Inference Attacks Against Generative Models (2017, background): “Additional membership inference attacks focus on genomic research studies [24, 5], whereby an attacker aims to infer the presence of a particular individual’s data within an aggregate genomic dataset, or aggregate locations [50].”
Machine Learning with Membership Privacy using Adversarial Regularization (2018, background): “Themembership inference attacks have mostly been studied for analyzing data privacywith respect to simple statistical linear functions [5, 17, 18, 23, 42, 43].”
Gradient-Leaks: Understanding and Controlling Deanonymization in Federated Learning (2018, background): “Research has also identi-ﬁed various sources of quasi-identiﬁers in unstructured data: proﬁle attributes [65], geo-location [66], social graph structure [48], content [31], stylometric features [3], or RNA expressions [6].”
Membership Inference Attacks on Machine Learning: A Survey (2021, background): “Also, recent papers [157, 158] have shown the feasibility of MIAs on location data.”
BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements (2020, background): “For instance, multiple works have explored the security and privacy threats of data used to train DNNmodels, such as membership inference attack [30, 35, 36], dataset reconstruction attack [33], and property inference attack [8, 12].”
Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observations (2020, background): “Membership Inference Attacks [32,19,17,26,29,30,27] try to guess if a particular sample was used for training a model.”
Label-Only Membership Inference Attacks (2020, background): “Existing membership inference attacks exploit the higher prediction confidence that models exhibit on their training data [7, 10, 11, 12, 13, 14].”
Demystifying Membership Inference Attacks in Machine Learning as a Service (2019, unknown): “Application-specific membership inference, such as [46], studied membership inference vulnerability specific to location data under a powerful adversary with deep prior knowledge.”
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning (2019, background): “It has been successfully performed in various settings, such as biomedical data [18, 21] and location data [36, 37].”
Systematic Evaluation of Privacy Risks of Machine Learning Models (2020, background): “It poses a severe privacy risk as the membership can reveal an individual’s sensitive information [3, 33].”
Membership Inference Attacks on Sequence-to-Sequence Models: Is My Data In Your Machine Translation System? (2019, background): “Pyrgelis et al. (2018) provides an empirical study on location data.”
Differentially Private Data Generative Models (2018, methodology): “Speciﬁcally, to quantitatively evaluate how our models deal with the membership inference attack, we use the metric privacy loss as deﬁned in [51].”
MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples (2019, background): “, attribute inference attacks [11, 17, 28], website fingerprinting attacks [7, 22, 29, 46, 67], side-channel attacks [73], location attacks [5, 45, 52, 72], and author identification attacks [8, 41].”
When Machine Unlearning Jeopardizes Privacy (2020, background): “It is a widely used metric to measure the performance of binary classification in a range of thresholds [5, 19, 27, 36, 56, 60].”