mlsanityData to 7 Oct 2026

Dissecting Distribution Inference

arXiv 2212.07591 ↗First posted 15 Dec 2022cs.LG cs.AI cs.CRcited by 15

Not on the map. Why?

Abstract (arXiv)

A distribution inference attack aims to infer statistical properties of data used to train machine learning models. These attacks are sometimes surprisingly potent, but the factors that impact distribution inference risk are not well understood and demonstrated attacks often rely on strong and unrealistic assumptions such as full knowledge of training environments even in supposedly black-box threat scenarios. To improve understanding of distribution inference risks, we develop a new black-box attack that even outperforms the best known white-box attack in most settings. Using this new attack, we evaluate distribution inference risk while relaxing a variety of assumptions about the adversary's knowledge under black-box access, like known model architectures and label-only access. Finally, we evaluate the effectiveness of previously proposed defenses and introduce new defenses. We find that although noise-based defenses appear to be ineffective, a simple re-sampling defense can be highly effective. Code is available at https://github.com/iamgroot42/dissecting_distribution_inference

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Builds on 33 of its 51 references that are in the map. First posted on arXiv 15 Dec 2022.

Builds on

33 of 51 references.

References · 33

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  3. 2016Densely Connected Convolutional Networkscited by 6,691
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
  6. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  7. 2016Deep Learning with Differential Privacycited by 2,682
  8. 2019A Survey on Bias and Fairness in Machine Learningcited by 1,911
  9. 2019Invariant Risk Minimizationcited by 1,832
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  11. 2017Renyi Differential Privacycited by 643
  12. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
21 more
  1. 2014Learning Face Representation from Scratchcited by 451
  2. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  3. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  4. 2013Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifierscited by 128
  5. 2021Property Inference From Poisoningcited by 56
  6. 2020Leakage of Dataset Properties in Multi-Party Machine Learningcited by 46
  7. 2021Formalizing and Estimating Distribution Inference Riskscited by 42
  8. 2022Geographic Spines in the 2020 Census Disclosure Avoidance Systemcited by 42
  9. 2021Property Inference Attacks Against GANscited by 32
  10. 2022SNAP: Efficient Extraction of Private Properties with Poisoningcited by 29
  11. 2022Group Property Inference Attacks Against Graph Neural Networkscited by 21
  12. 2019Alleviating Privacy Attacks via Causal Learningcited by 19
  13. 2020Attribute Privacy: Framework and Mechanismscited by 19
  14. 2022Subject Membership Inference Attacks in Federated Learningcited by 18
  15. 2022Distribution inference risks: Identifying and mitigating sources of leakagecited by 17
  16. 2022Protecting Global Properties of Datasets with Distribution Privacy Mechanismscited by 11
  17. 2018Local Obfuscation Mechanisms for Hiding Probability Distributionscited by 8
  18. 2022Measuring Unintended Memorisation of Unique Private Features in Neural Networkscited by 5
  19. 2022Black-Box Audits for Group Distribution Shiftscited by 5
  20. 2022Comment: The Essential Role of Policy Evaluation for the 2020 Census Disclosure Avoidance Systemcited by 2
  21. 2022Lessons Learned: Defending Against Property Inference Attackscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 6; 2024: 2; 2025: 3; 2026: 3.

15 papers.

Sort:

By area:

  1. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  2. 2023SoK: Memorization in General-Purpose Large Language Modelscited by 36
  3. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  4. 2023Summary Statistic Privacy in Data Sharingcited by 6
  5. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  6. 2023Attesting Distributional Properties of Training Data for Machine Learningcited by 5
  7. 2023Privacy Measurement in Tabular Synthetic Data: State of the Art and Future Research Directionscited by 4
  8. 2024Subject Data Auditing via Source Inference Attack in Cross-Silo Federated Learningcited by 2
  9. 2025Amulet: a Python Library for Assessing Interactions Among ML Defenses and Riskscited by 1
  10. 2026Alignment Defends LLMs from Property Inference Attackscited by 1
  11. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  12. 2025Black-Box Privacy Attacks on Shared Representations in Multitask Learningcited by 0
3 more
  1. 2025Membership Inference Attack with Partial Featurescited by 0
  2. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  3. 2026QuanText: Protecting Dataset-Level Secrets in Textual Data Sharingcited by 0