Empirical inference attacks are a popular approach for evaluating the privacy risk of data release mechanisms in practice. While an active attack literature exists to evaluate machine learning models or synthetic data release, we currently lack comparable methods for fixed aggregate statistics, in particular when only a limited number of statistics are released. We here propose an inference attack framework against fixed aggregate statistics and an attribute inference attack called DeSIA. We instantiate DeSIA against the U.S. Census PPMF dataset and show it to strongly outperform reconstruction-based attacks. In particular, we show DeSIA to be highly effective at identifying vulnerable users, achieving a true positive rate of 0.14 at a false positive rate of $10^{-3}$. We then show DeSIA to perform well against users whose attributes cannot be verified and when varying the number of aggregate statistics and level of noise addition. We also perform an extensive ablation study of DeSIA and show how DeSIA can be successfully adapted to the membership inference task. Overall, our results show that aggregation alone is not sufficient to protect privacy, even when a relatively small number of aggregates are being released, and emphasize the need for formal privacy mechanisms and testing before aggregate statistics are released.

本研究针对现有聚合统计方法中存在的隐私风险进行了探讨，提出了一种名为DeSIA的属性推断攻击框架。研究结果表明，DeSIA在识别易受攻击用户方面表现优异，真阳性率达到0.14，在错误阳性率为$10^{-3}$的情况下显著优于重建攻击。此发现强调了聚合统计数据不足以保护隐私，推动了在发布统计数据前进行正式隐私机制和测试的必要性。

DeSIA：针对有限固定聚合统计数据的属性推断攻击