# Protecting Global Properties of Datasets with Distribution Privacy Mechanisms

arXiv: https://arxiv.org/abs/2207.08367 · HTML: https://mlsanity.com/paper/2207.08367/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 47 references that are in the map.
- First posted on arXiv 18 Jul 2022.

## Builds on (most cited first, 18 of 18)

- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Renyi Differential Privacy](https://mlsanity.com/paper/1702.07476/) (2017)
- [Exploiting Unintended Feature Leakage in Collaborative Learning](https://mlsanity.com/paper/1805.04049/) (2018)
- [Statistical Aspects of Wasserstein Distances](https://mlsanity.com/paper/1806.05500/) (2018)
- [Collecting Telemetry Data Privately](https://mlsanity.com/paper/1712.01524/) (2017)
- [Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifiers](https://mlsanity.com/paper/1306.4447/) (2013)
- [Unleashing the Tiger: Inference Attacks on Split Learning](https://mlsanity.com/paper/2012.02670/) (2020)
- [Differentially Private Model Publishing for Deep Learning](https://mlsanity.com/paper/1904.02200/) (2019)
- [Property Inference From Poisoning](https://mlsanity.com/paper/2101.11073/) (2021)
- [Leakage of Dataset Properties in Multi-Party Machine Learning](https://mlsanity.com/paper/2006.07267/) (2020)
- [Formalizing and Estimating Distribution Inference Risks](https://mlsanity.com/paper/2109.06024/) (2021)
- [Attribute Privacy: Framework and Mechanisms](https://mlsanity.com/paper/2009.04013/) (2020)
- [Pufferfish Privacy Mechanisms for Correlated Data](https://mlsanity.com/paper/1603.03977/) (2016)
- [Local Obfuscation Mechanisms for Hiding Probability Distributions](https://mlsanity.com/paper/1812.00939/) (2018)
- [Towards Practical Privacy-Preserving Analytics for IoT and Cloud Based Healthcare Systems](https://mlsanity.com/paper/1804.04250/) (2018)
- [Kantorovich Mechanism for Pufferfish Privacy](https://mlsanity.com/paper/2201.07388/) (2022)
- [A study of the dual problem of the one-dimensional L-infinity optimal transport problem with applications](https://mlsanity.com/paper/1704.02730/) (2017)

## Built on by (most cited first, 11 of 11)

- [Dissecting Distribution Inference](https://mlsanity.com/paper/2212.07591/) (2022)
- [Summary Statistic Privacy in Data Sharing](https://mlsanity.com/paper/2303.02014/) (2023)
- [SoK: Unintended Interactions among Machine Learning Defenses and Risks](https://mlsanity.com/paper/2312.04542/) (2023)
- [Attesting Distributional Properties of Training Data for Machine Learning](https://mlsanity.com/paper/2308.09552/) (2023)
- [R'enyi Pufferfish Privacy: General Additive Noise Mechanisms and Privacy Amplification by Iteration](https://mlsanity.com/paper/2312.13985/) (2023)
- [FLMarket: Enabling Privacy-preserved Pre-training Data Pricing for Federated Learning](https://mlsanity.com/paper/2411.11713/) (2024)
- [Alignment Defends LLMs from Property Inference Attacks](https://mlsanity.com/paper/2606.10217/) (2026)
- [Threats, Vulnerabilities, and Controls of Machine Learning Based Systems: A Survey and Taxonomy](https://mlsanity.com/paper/2301.07474/) (2023)
- [Code-Poisoning Property Inference Attacks](https://mlsanity.com/paper/2607.15970/) (2026)
- [Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images](https://mlsanity.com/paper/2608.17147/) (2026)
- [Masking Radar Cognition under Adversarial Surveillance: A Distributional Privacy Framework](https://mlsanity.com/paper/2609.07428/) (2026)

## Abstract (arXiv)

We consider the problem of ensuring confidentiality of dataset properties aggregated over many records of a dataset. Such properties can encode sensitive information, such as trade secrets or demographic data, while involving a notion of data protection different to the privacy of individual records typically discussed in the literature. In this work, we demonstrate how a distribution privacy framework can be applied to formalize such data confidentiality. We extend the Wasserstein Mechanism from Pufferfish privacy and the Gaussian Mechanism from attribute privacy to this framework, then analyze their underlying data assumptions and how they can be relaxed. We then empirically evaluate the privacy-utility tradeoffs of these mechanisms and apply them against a practical property inference attack which targets global properties of datasets. The results show that our mechanisms can indeed reduce the effectiveness of the attack while providing utility substantially greater than a crude group differential privacy baseline. Our work thus provides groundwork for theoretical mechanisms for protecting global properties of datasets along with their evaluation in practice.