Research map / Federated learning and privacy / Differential privacy
Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Uses f-DP's hypothesis-testing view to derive a single baseline-dependent bound (succ ≤ 1 − f(base)) that unifies singling-out, attribute inference, and reconstruction risks under the strong adversary model, yielding tighter risk estimates and ~20% less noise in DP-SGD.
Problem
Existing conversions from DP parameters (epsilon, delta) to concrete re-identification, attribute inference, and data reconstruction risks are overly pessimistic and inconsistent across risk notions.
Approach
Using the hypothesis-testing (f-DP) characterization, attack success under any of SPSO, SRR, or SAI is bounded by 1 - f(baseline) with the same form, giving tunable baseline-dependent bounds on success and advantage, plus a baseline-independent TV bound.
Key results
- Calibrating noise with the unified bound at worst-case reconstruction risk 0.15 raises SST-2 accuracy from 52% to 70% versus the RDP-based analysis, with about 20% less noise at the same risk.
- On the US 2020 Census release, the unified bound indicates up to 33% less worst-case reconstruction risk than the zCDP analysis.
- For attribute inference at epsilon=10.6, the worst-case bound gives 52pp versus 73pp for RDP-based analysis and over 99pp for the standard analysis.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the unified f-DP bound instead of standard risk analysis | Privacy-risk analysis of the US 2020 Census state-level release · US 2020 Census state-level | worst-case attribute inference advantage: >99 percentage points -> 52pp | Helped |
| Use the unified f-DP bound instead of RDP analysis | Privacy-risk analysis of the US 2020 Census state-level release · US 2020 Census state-level | worst-case attribute inference advantage: 73pp -> 52pp | Helped |
| Calibrate DP-SGD noise with the unified f-DP bound instead of RDP analysis | GPT-2 small with DP-LoRA · SST-2 | test accuracy: 52% -> 70% | Helped |
| Use the unified f-DP bound for noise calibration instead of prior methods | DP mechanisms calibrated to a fixed operational-risk level · DP noise calibration | required noise: 20% | Helped |
| Use the unified f-DP bound instead of prior methods | US 2020 Census release risk analysis · US 2020 Census release | worst-case reconstruction risk: up to 33% lower risk | Helped |
| Use the unified f-DP bound instead of prior bounds | Gaussian mechanism reconstruction-robustness analysis · Reconstruction robustness | attack advantage | Helped |
| Use the unified f-DP bound instead of average-dataset PSO bounds | Predicate singling-out risk analysis · Predicate singling-out | attack advantage | Helped |
Surprising findings
- Under the strong threat model, the SPSO bound shows lower risk than the PSO bound from the average-dataset threat model based on (epsilon, delta)-DP.
- The authors conjecture the unified bound is tight in the most general case, though this is unverified.
Limitations
- Bounds are not verified tight in general; tightness is only conjectured.
- Risk is measured per privacy unit (single record), which may not map to individuals for LLM training data.
- Baseline risk must be modeled carefully, and a low baseline can lead to gaming or underestimated risk.
Experimental setup
Datasets: SST-2 US 2020 Census CIFAR-10
Benchmarks: SST-2 US 2020 Census CIFAR-10
Metrics: attack success minus baseline (advantage) worst-case risk classification accuracy
Baselines: RDP-based reconstruction bound zCDP-based reconstruction bound PSO bound from (epsilon, delta)-DP Monte-Carlo f-DP reconstruction estimate
Builds on: f-DP Rényi DP zCDP predicate singling out attack-aware noise calibration
Closest papers by meaning
- A Unified Framework for Adversary-Aware Differential Privacy Bounds (NeurIPS 2026 · similarity 0.91)
- Attack-Aware Noise Calibration for Differential Privacy (NeurIPS 2024 · similarity 0.90)
- Auditing Privacy Mechanisms via Label Inference Attacks (NeurIPS 2024 · similarity 0.89)
- Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy (NeurIPS 2026 · similarity 0.88)
- Beyond the Calibration Point: Mechanism Comparison in Differential Privacy (ICML 2024 · similarity 0.88)
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.