# You are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviors

arXiv: https://arxiv.org/abs/1606.05893 · HTML: https://mlsanity.com/paper/1606.05893/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Jun 2016.

## Built on by (most cited first, 30 of 34)

- [Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection](https://mlsanity.com/paper/2210.00875/) (2022)
- [Bag of Tricks for Training Data Extraction from Language Models](https://mlsanity.com/paper/2302.04460/) (2023)
- ["Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practice](https://mlsanity.com/paper/2212.14315/) (2022)
- [Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Models](https://mlsanity.com/paper/2201.09370/) (2022)
- [Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models](https://mlsanity.com/paper/2208.10445/) (2022)
- [A Privacy-Preserving Hybrid Federated Learning Framework for Financial Crime Detection](https://mlsanity.com/paper/2302.03654/) (2023)
- [On the Alignment of Group Fairness with Attribute Privacy](https://mlsanity.com/paper/2211.10209/) (2022)
- [A Comprehensive Study on Dataset Distillation: Performance, Privacy, Robustness and Fairness](https://mlsanity.com/paper/2305.03355/) (2023)
- [Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures](https://mlsanity.com/paper/2403.14772/) (2024)
- [Beyond Gradients: Exploiting Adversarial Priors in Model Inversion Attacks](https://mlsanity.com/paper/2203.00481/) (2022)
- [User Consented Federated Recommender System Against Personalized Attribute Inference Attack](https://mlsanity.com/paper/2312.16203/) (2023)
- [10 Security and Privacy Problems in Large Foundation Models](https://mlsanity.com/paper/2110.15444/) (2021)
- [SoK: On the Offensive Potential of AI](https://mlsanity.com/paper/2412.18442/) (2024)
- [Privacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A Survey](https://mlsanity.com/paper/2105.06300/) (2021)
- [PEPPER: Empowering User-Centric Recommender Systems over Gossip Learning](https://mlsanity.com/paper/2208.05320/) (2022)
- [Attribute Inference Attacks in Online Multiplayer Video Games: a Case Study on Dota2](https://mlsanity.com/paper/2210.09028/) (2022)
- [NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attacks](https://mlsanity.com/paper/2206.05565/) (2022)
- [Unveiling the Role of Message Passing in Dual-Privacy Preservation on GNNs](https://mlsanity.com/paper/2308.13513/) (2023)
- [Disparate Privacy Vulnerability: Targeted Attribute Inference Attacks and Defenses](https://mlsanity.com/paper/2504.04033/) (2025)
- [Pareto-Secure Machine Learning (PSML): Fingerprinting and Securing Inference Serving Systems](https://mlsanity.com/paper/2307.01292/) (2023)
- ["All of Me": Mining Users' Attributes from their Public Spotify Playlists](https://mlsanity.com/paper/2401.14296/) (2024)
- [Inference Attacks: A Taxonomy, Survey, and Promising Directions](https://mlsanity.com/paper/2406.02027/) (2024)
- [Large-Scale Privacy-Preserving Network Embedding against Private Link Inference Attacks](https://mlsanity.com/paper/2205.14440/) (2022)
- [RAID: An In-Training Defense against Attribute Inference Attacks in Recommender Systems](https://mlsanity.com/paper/2504.11510/) (2025)
- [SoK: Data Minimization in Machine Learning](https://mlsanity.com/paper/2508.10836/) (2025)
- [HyObscure: Hybrid Obscuring for Privacy-Preserving Data Publishing](https://mlsanity.com/paper/2112.07850/) (2021)
- [DP-SGD-Global-Adapt-V2-S: Triad Improvements of Privacy, Accuracy and Fairness via Step Decay Noise Multiplier and Step Decay Upper Clipping Threshold](https://mlsanity.com/paper/2312.02400/) (2023)
- [Privacy Challenges in Meta-Learning: An Investigation on Model-Agnostic Meta-Learning](https://mlsanity.com/paper/2406.00249/) (2024)
- [Deep Learning with Data Privacy via Residual Perturbation](https://mlsanity.com/paper/2408.05723/) (2024)
- [Natural Language Querying System Through Entity Enrichment](https://mlsanity.com/paper/2410.15753/) (2024)

## Abstract (arXiv)

We propose new privacy attacks to infer attributes (e.g., locations, occupations, and interests) of online social network users. Our attacks leverage seemingly innocent user information that is publicly available in online social networks to infer missing attributes of targeted users. Given the increasing availability of (seemingly innocent) user information online, our results have serious implications for Internet privacy -- private attributes can be inferred from users' publicly available data unless we take steps to protect users from such inference attacks. To infer attributes of a targeted user, existing inference attacks leverage either the user's publicly available social friends or the user's behavioral records (e.g., the webpages that the user has liked on Facebook, the apps that the user has reviewed on Google Play), but not both. As we will show, such inference attacks achieve limited success rates. However, the problem becomes qualitatively different if we consider both social friends and behavioral records. To address this challenge, we develop a novel model to integrate social friends and behavioral records and design new attacks based on our model. We theoretically and experimentally demonstrate the effectiveness of our attacks. For instance, we observe that, in a real-world large-scale dataset with 1.1 million users, our attack can correctly infer the cities a user lived in for 57% of the users, via confidence estimation, we are able to increase the attack success rate to over 90% if the attacker selectively attacks a half of the users. Moreover, we show that our attack can correctly infer attributes for significantly more users than previous attacks.