FERMI: Exploiting Relations for Membership Inference Against Tabular Diffusion Models

2026-05-12

AI Summary

This work addresses the limitation of existing membership inference attacks, which overlook the multi-table relational structure inherent in real-world tabular data and thus fail to accurately assess the privacy risks of diffusion-based synthetic data. The authors propose FERMI, the first method to incorporate relational structure into membership inference against tabular diffusion models. By leveraging a feature mapping mechanism that integrates auxiliary information from associated parent tables during training, FERMI embeds relational membership signals into single-table features, thereby enhancing attack performance under the realistic asymmetric setting where only the target table is observable. Compatible with various diffusion architectures, FERMI supports both white-box and black-box scenarios. Experiments on three real relational datasets demonstrate its superiority over single-table baselines, achieving up to a 53% improvement in TPR@0.1FPR under white-box settings and 22% under black-box settings.

Abstract

Diffusion models are the leading approach for tabular data synthesis and are increasingly used to share sensitive records. Whether they actually protect privacy has become a pressing question. Membership inference attacks are the standard tool for this purpose, yet existing attacks assume a single-table setting and ignore the multi-relational structure of real sensitive data. A core challenge in assessing privacy risks from membership inference attacks in multi-table settings is how to leverage auxiliary information from relations associated with the target table, such as its parent tables. Particularly, we study a practical setting in which such auxiliary information is available only when training the attack model. At inference time, the attacker observes only the attribute values of the target record from the target table. We propose FERMI (FEature-mapping for Relational Membership Inference), which resolves this gap by enriching single-table features with relational membership signal. Across three tabular diffusion architectures and three real-world relational datasets, FERMI consistently improves attack performance over single-table baselines, with TPR@$0.1$FPR rising by up to 53% over the single-table baseline in the white-box setting and 22% in the black-box setting.

Problem

• membership inference
• tabular diffusion models
• multi-relational data
• privacy risk
• auxiliary information

Innovation

• membership inference
• tabular diffusion models
• relational data
• privacy attack
• FERMI