Research map / Federated learning and privacy / Privacy attacks and secure learning
Auditing Privacy Mechanisms via Label Inference Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes additive and multiplicative reconstruction-advantage measures to audit label privatization mechanisms (randomized response, learning from label proportions, and LLP with noise), and compares their privacy-utility tradeoffs empirically and theoretically.
Problem
Auditing how much privatized label releases (randomized response, label aggregation/LLP, noisy aggregates) increase an adversary's ability to infer true labels, placing heuristic aggregation and differentially private mechanisms on a common footing.
Approach
Define distributional reconstruction advantage measures (additive EAdv/IEAdv as difference of optimal informed vs uninformed attack utility, and multiplicative log-odds-ratio advantage) that compare an adversary's posterior to its prior from features alone, and use them to compare the privacy-utility tradeoff of RR, LLP, and LLP+noise.
Key results
- For RR at epsilon=1 the additive attack advantage on one dataset is only 0.00095, far below the distribution-free DP bound of about 0.46.
- LLP exhibits unbounded multiplicative advantage on skewed data (KDD12) due to homogeneous bags, whereas RR and LLP+Lap/Geom have bounded multiplicative advantage.
- Differentially private schemes (RR, LLP+noise) dominate or match the AUC vs. advantage tradeoff of plain label aggregation for most privacy levels.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use randomized response instead of label aggregation (LLP) | Label privatization mechanisms · Higgs and KDD12 | multiplicative advantage at comparable utility | Helped |
| Use LLP instead of randomized response at comparable AUC | Label privatization mechanisms · Higgs and KDD12 | multiplicative advantage | Hurt |
| Use LLP+Geom instead of LLP | Label privatization mechanisms · Synthetic datasets and KDD12 | frequency of extreme multiplicative advantage | Helped |
| Compare RR, LLP, and LLP+Geom at AUC-comparable settings | Label privatization mechanisms · Higgs and KDD12 | additive advantage | No clear effect |
| Use differentially private schemes rather than heuristic label aggregation | Label privatization mechanisms · Experimental settings across benchmark and synthetic datasets | privacy-utility tradeoff | Helped |
| Increase LLP bag size | LLP · Synthetic settings under independent labels and features | additive attack advantage | Helped |
Surprising findings
- Deterministic label aggregation (LLP) does not give a significant privacy advantage over DP mechanisms even when measured on its own terms, and is often strictly harder to learn from than randomized labels.
- Under multiplicative advantage, LLP can leak labels exactly for some bags, yielding infinite advantage on skewed datasets.
Limitations
- Measures assume i.i.d. sampling and that the adversary's label uncertainty can be estimated; they break under significant adversary side information or reuse of the same data across mechanisms.
- Experiments estimate eta(x) with a classifier trained without PETs, so advantage values are proxies for non-synthetic data.
- Only binary single-bit labels with public features are considered.
Experimental setup
Datasets: Higgs KDD12 synthetic Beta(2,30) datasets
Benchmarks: Higgs KDD12
Metrics: AUC additive expected attack advantage multiplicative advantage
Baselines: Randomized response (RR) LLP (label aggregation) LLP+Laplace LLP+Geometric
Builds on: Expected Attack Utility (reconstruction advantage) Randomized response Empirical Proportion Risk Minimization / PropMatch Label differential privacy
Closest papers by meaning
- Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy (NeurIPS 2025 · similarity 0.89)
- Auditing Private Prediction (ICML 2024 · similarity 0.86)
- Enhancing Learning with Label Differential Privacy by Vector Approximation (ICLR 2025 · similarity 0.86)
- Auditing $f$-differential privacy in one run (ICML 2025 · similarity 0.86)
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.86)
- Sequentially Auditing Differential Privacy (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.