A Bayesian Approach to Membership Inference Attacks in Statistical Release Scenarios

The researchers propose a Bayesian membership inference attack framework for statistical disclosure, modeling the population as a Bayesian network to exploit attribute dependency structure. Most existing attacks model the population using only marginal information, and formal analyses mostly target product-distribution populations; the new framework is based on Bayesian decision-making and can incorporate the population prior information held by the attacker, motivated by scenarios in which multiple parties such as the U.S. Census Bureau and the Internal Revenue Service (IRS) may hold similarly structured data. The authors implemented an attack instance that computes the Bayesian posterior in the probabilistic programming language Roulette, proving that on two populations with strong attribute dependencies it is equivalent to the optimal variant of the likelihood ratio test attack; experiments on five commonly used Bayesian networks show that the attack outperforms the likelihood ratio test and inner-product attacks, and the dependency structures of these populations are too complex for existing attacks to be manually adapted.