A Bayesian Approach to Membership Inference for Statistical Release

2026-05-28

AI Summary

This work addresses the privacy threat in statistical releases where adversaries exploit dependency structures among group attributes to perform membership inference attacks. To model such attacks, the paper introduces Bayesian networks into membership inference for the first time and proposes a general attack framework that incorporates prior knowledge of group-level dependencies. Built upon Bayesian decision theory, the framework is equivalent to the optimal likelihood ratio test and is implemented using probabilistic programming (Roulette language). Experimental evaluation on five representative Bayesian network structures demonstrates that the proposed method significantly outperforms conventional likelihood ratio tests and inner product attacks, with particularly pronounced gains in scenarios involving complex dependency structures.

Abstract

The membership inference problem for publicly released statistics from a private dataset is well-studied. When developing and formally analyzing attack strategies, however, the focus has been on attacks that model the population using only its marginals. In practice, these attacks can perform well on various populations, however most formal analysis is for populations that follow a product distribution. These strategies may fail to leverage useful information about the population that is important for understanding a realistic privacy threat. In this work, we explore the impact of providing an attacker with additional information about the attribute dependency structure of the population, motivated by examples where multiple parties may have access to similarly structured data, for example the US Census and the IRS. To model this scenario, we re-frame the membership inference problem with respect to a population represented as a Bayesian network (BN). We develop a framework based on Bayesian decision-making which can incorporate prior information about the population to launch more effective, specialized attacks. To evaluate our framework, we introduce a specific attack instantiation which computes the Bayesian posterior using a probabilistic program, and prove its equivalence to an optimal variant of the likelihood ratio test attack for two populations with strong attribute dependency. We implement our program in the Roulette probabilistic programming language and show experimentally that it outperforms the likelihood ratio test and inner product attacks on five commonly used BNs, where the population dependency structure is too complex for the existing attacks to be manually adapted.

Problem

• membership inference
• statistical release
• attribute dependency
• Bayesian network
• privacy threat

Innovation

• Bayesian network
• membership inference
• probabilistic programming
• likelihood ratio test
• attribute dependency