# Attribute Privacy: Framework and Mechanisms

arXiv: https://arxiv.org/abs/2009.04013 · HTML: https://mlsanity.com/paper/2009.04013/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Sep 2020.

## Built on by (most cited first, 19 of 19)

- [Formalizing and Estimating Distribution Inference Risks](https://mlsanity.com/paper/2109.06024/) (2021)
- [Outlier-Robust Optimal Transport: Duality, Structure, and Statistical Analysis](https://mlsanity.com/paper/2111.01361/) (2021)
- [Inferring Sensitive Attributes from Model Explanations](https://mlsanity.com/paper/2208.09967/) (2022)
- [Dissecting Distribution Inference](https://mlsanity.com/paper/2212.07591/) (2022)
- [A domain-specific language for describing machine learning datasets](https://mlsanity.com/paper/2207.02848/) (2022)
- [Protecting Global Properties of Datasets with Distribution Privacy Mechanisms](https://mlsanity.com/paper/2207.08367/) (2022)
- [Quantum Pufferfish Privacy: A Flexible Privacy Framework for Quantum Systems](https://mlsanity.com/paper/2306.13054/) (2023)
- [The Eye of Sherlock Holmes: Uncovering User Private Attribute Profiling via Vision-Language Model Agentic Framework](https://mlsanity.com/paper/2505.19139/) (2025)
- [Summary Statistic Privacy in Data Sharing](https://mlsanity.com/paper/2303.02014/) (2023)
- [SoK: Unintended Interactions among Machine Learning Defenses and Risks](https://mlsanity.com/paper/2312.04542/) (2023)
- [Privacy Measurement in Tabular Synthetic Data: State of the Art and Future Research Directions](https://mlsanity.com/paper/2311.17453/) (2023)
- [Crowding Out The Noise: Algorithmic Collective Action Under Differential Privacy](https://mlsanity.com/paper/2505.05707/) (2025)
- [Minimizing Risk Through Minimizing Model-Data Interaction: A Protocol For Relying on Proxy Tasks When Designing Child Sexual Abuse Imagery Detection Models](https://mlsanity.com/paper/2505.06621/) (2025)
- [R'enyi Pufferfish Privacy: General Additive Noise Mechanisms and Privacy Amplification by Iteration](https://mlsanity.com/paper/2312.13985/) (2023)
- [Machine Learning with Privacy for Protected Attributes](https://mlsanity.com/paper/2506.19836/) (2025)
- [Alignment Defends LLMs from Property Inference Attacks](https://mlsanity.com/paper/2606.10217/) (2026)
- [A Shuffling Framework for Local Differential Privacy](https://mlsanity.com/paper/2106.06603/) (2021)
- [Integrating Feature Correlation in Differential Privacy with Applications in DP-ERM](https://mlsanity.com/paper/2605.03945/) (2026)
- [Predictability as a Fine-Grained Measure for Privacy](https://mlsanity.com/paper/2606.20546/) (2026)

## Abstract (arXiv)

Ensuring the privacy of training data is a growing concern since many machine learning models are trained on confidential and potentially sensitive data. Much attention has been devoted to methods for protecting individual privacy during analyses of large datasets. However in many settings, global properties of the dataset may also be sensitive (e.g., mortality rate in a hospital rather than presence of a particular patient in the dataset). In this work, we depart from individual privacy to initiate the study of attribute privacy, where a data owner is concerned about revealing sensitive properties of a whole dataset during analysis. We propose definitions to capture attribute privacy in two relevant cases where global attributes may need to be protected: (1) properties of a specific dataset and (2) parameters of the underlying distribution from which dataset is sampled. We also provide two efficient mechanisms and one inefficient mechanism that satisfy attribute privacy for these settings. We base our results on a novel use of the Pufferfish framework to account for correlations across attributes in the data, thus addressing "the challenging problem of developing Pufferfish instantiations and algorithms for general aggregate secrets" that was left open by citekifer2014pufferfish.