Research map / Adversarial robustness and security / Attacks on text and graphs

Membership Inference on Synthetic Single-Cell Genomic Data

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: Membership inference and inversion · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Adapts the MAMA-MIA marginals-based membership inference attack to scDesign2 (scMAMA-MIA) and shows donor-level membership inference on synthetic scRNA-seq data far above random guessing, especially with few training donors.

Problem

Whether synthetic single-cell RNA-seq data generated by scDesign2 leaks which donors were used to train the generator, since existing membership inference attacks rarely beat random guessing on high-dimensional genomic data.

Approach

Exploits scDesign2's known generative structure: it measures per-cell Mahalanobis distances to the Gaussian copula covariance learned on the synthetic data (or white-box training copula), calibrated against a copula fit on auxiliary data, and aggregates cell-level scores to donor-level membership predictions.

Key results

• scMAMA-MIA outperforms LOGAN, GAN-Leaks, DOMIAS and Monte Carlo baselines across donor sample sizes and datasets, achieving perfect AUC when only a few donors train the generator.
• White-box threat model yields higher AUC than black-box, and white-box without auxiliary data appears stronger than black-box with auxiliary data.
• Privacy leakage decreases and synthetic data quality improves as the number of training donors grows; demographic disparities in attack success are not large.

Surprising findings

• Attack success is only weakly tied to demographic group size, with no large disparate impact across sex or ethnicity subgroups.
• Attacker with white-box access to the copula can learn more than one with auxiliary data alone, under the reported comparison.

Limitations

• Baseline attacks from CAMDA2025 could not run beyond 20 donors, limiting comparison at larger sizes.
• Memory constraints prevented running AIDA experiments above 50 donors.
• Attack evaluated only on scDesign2; generalization to other scRNA-seq generators is not shown.

Experimental setup

Datasets: OneK1K AIDA HFRA

Benchmarks: OneK1K AIDA HFRA

Metrics: ROC AUC LISI ARI MMD

Baselines: LOGAN GAN-Leaks DOMIAS Monte Carlo attack

Builds on: MAMA-MIA scDesign2

Closest papers by meaning

• The Canary’s Echo: Auditing Privacy Risks of LLM-Generated Synthetic Text (ICML 2025 · similarity 0.86)
• Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.85)
• Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.85)
• CaPS: Collaborative and Private Synthetic Data Generation from Distributed Sources (ICML 2024 · similarity 0.84)
• Privacy Amplification Through Synthetic Data: Insights from Linear Regression (ICML 2025 · similarity 0.84)
• Privacy Amplification Persists under Unlimited Synthetic Data Release (NeurIPS 2026 · similarity 0.84)