Exposed! A Survey of Attacks on Private Data

Abstract

Privacy-preserving statistical data analysis addresses the general question of protecting privacy when publicly releasing information about a sensitive dataset. A privacy attack takes seemingly innocuous released information and uses it to discern the private details of individuals, thus demonstrating that such information compromises privacy. For example, re-identification attacks have shown that it is easy to link supposedly de-identified records to the identity of the individual concerned. This survey focuses on attacking aggregate data, such as statistics about how many individuals have a certain disease, genetic trait, or combination thereof. We consider two types of attacks: reconstruction attacks, which approximately determine a sensitive feature of all the individuals covered by the dataset, and tracing attacks, which determine whether or not a target individual's data is included in the dataset. We also discuss techniques from the differential privacy literature for releasing approximate aggregate statistics while provably thwarting any privacy attack.

Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity

“…Anonymous data collection. As a pragmatic means for reducing privacy risks, reports are typically anonymized and often aggregated in deployments of monitoring by careful operators (e.g., RAPPOR [EPK14])even though anonymity is no privacy panacea [DSSU17,Dez18].…”

Machine Learning with Membership Privacy using Adversarial Regularization

“…However, machine learning models, similar to other types of computations, could significantly leak information about the datasets on which they are computed. In particular, an adversary, with even black-box access to a model, can perform a membership inference [23,43] (also known as the tracing [17]) attack against the model to determine whether or not a target data record is a member of its training set [45]. The adversary exploits the distinctive statistical features of the model's predictions on its training data.…”

Leveraging Hierarchical Representations for Preserving Privacy and Utility in Text

“…Furthermore, there were existing artifacts such as the Poincaré embeddings by [18] built with this model that we could reuse for this work. 1 The metric tensor (like a dot product) gives local notions of length and angle between tangent vectors. By integration local segments, the metric tensor allows us to calculate the global length of curves in the manifold…”

“…These all go to illustrate that the traditional notion of PII which is used to build anonymization systems is fundamentally flawed [8]. Essentially, any part of a user's information can be used to launch these attacks, and we are therefore in a post-PII era [1]. This effect is more pronounced in naturally generated text as opposed to statistical data where techniques such as Differential Privacy (DP) have been established as a de facto way to mitigate these attacks.…”