[Paper Review] Membership Inference Attacks against Synthetic Data through Overfitting Detection

Boris van Breugel, Hao Sun+2 more|arXiv (Cornell University)|Feb 24, 2023

Privacy-Preserving Technologies in Data25 citations

TL;DR

The paper introduces DOMIAS, a density-based membership inference attack against synthetic data that leverages a reference dataset to detect local overfitting and assess privacy risk.

ABSTRACT

Data is the foundation of most science. Unfortunately, sharing data can be obstructed by the risk of violating data privacy, impeding research in fields like healthcare. Synthetic data is a potential solution. It aims to generate data that has the same distribution as the original data, but that does not disclose information about individuals. Membership Inference Attacks (MIAs) are a common privacy attack, in which the attacker attempts to determine whether a particular real sample was used for training of the model. Previous works that propose MIAs against generative models either display low performance -- giving the false impression that data is highly private -- or need to assume access to internal generative model parameters -- a relatively low-risk scenario, as the data publisher often only releases synthetic data, not the model. In this work we argue for a realistic MIA setting that assumes the attacker has some knowledge of the underlying data distribution. We propose DOMIAS, a density-based MIA model that aims to infer membership by targeting local overfitting of the generative model. Experimentally we show that DOMIAS is significantly more successful at MIA than previous work, especially at attacking uncommon samples. The latter is disconcerting since these samples may correspond to underrepresented groups. We also demonstrate how DOMIAS' MIA performance score provides an interpretable metric for privacy, giving data publishers a new tool for achieving the desired privacy-utility trade-off in their synthetic data.

Motivation & Objective

• Motivate a realistic MIA setting for synthetic data where an attacker has some knowledge of the underlying data distribution.
• Propose DOMIAS to detect local overfitting by comparing generator and real data densities with a reference distribution.
• Show that DOMIAS outperforms prior MIAs, especially on underrepresented (low-density) samples.
• Demonstrate how DOMIAS can guide privacy-aware synthetic data generation and evaluation.

Proposed method

• Define DOMIAS as A_DOMIAS(x*) = f(p_G(x*) / p_R(x*)), weighting generator density by the true data density.
• Use a reference dataset D_ref to approximate p_R(X) and a density estimator for p_G(X) to compute the MIA score.
• Argue and prove that the density ratio-based score is invariant to invertible data representations (Theorem 1).
• Compare DOMIAS to prior MIAs that rely on p_G alone, showing access to D_ref yields stronger attacks.
• Empirically evaluate DOMIAS on datasets (e.g., California Housing, Heart Failure) with various generative models (TVAE, GAN variants) and baselines.

(a) Generative distribution in original space

Experimental results

Research questions

• RQ1 Can a density ratio-based MIA that incorporates a reference distribution outperform previous black-box MIAs on synthetic data?
• RQ2 Does targeting local overfitting via p_G/p_R improve detection of membership, especially in low-density regions representing underrepresented groups?
• RQ3 How does DOMIAS perform across different generative models and dataset sizes, and what is the privacy-utility trade-off?
• RQ4 Can DOMIAS serve as a practical metric to guide privacy-preserving synthetic data generation?

Key findings

• DOMIAS consistently outperforms baselines in MIA accuracy across datasets and models.
• Using the reference distribution (Eq. 2) provides larger gains than prior Eq. 1 based attacks.
• DOMIAS is more effective at attacking minority/underrepresented groups in synthetic data.
• The attack score serves as an interpretable metric for privacy risk, aiding privacy-utility trade-off decisions.
• There is a clear privacy-utility Pareto frontier; higher data quality may come with higher MIA vulnerability, depending on the model.

(b) Distribution in log-transformed space