# Towards more accurate and useful data anonymity vulnerability measures

arXiv: https://arxiv.org/abs/2403.06595 · HTML: https://mlsanity.com/paper/2403.06595/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 15 of its 44 references that are in the map.
- First posted on arXiv 11 Mar 2024.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 15 of 15)

- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Membership Inference Attacks on Machine Learning: A Survey](https://mlsanity.com/paper/2103.07853/) (2021)
- [Enhanced Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/2111.09679/) (2021)
- [Synthetic Data -- Anonymisation Groundhog Day](https://mlsanity.com/paper/2011.07018/) (2020)
- [Knock Knock, Who's There? Membership Inference on Aggregate Location Data](https://mlsanity.com/paper/1708.06145/) (2017)
- [A Unified Framework for Quantifying Privacy Risk in Synthetic Data](https://mlsanity.com/paper/2211.10459/) (2022)
- [SoK: Differential Privacies](https://mlsanity.com/paper/1906.01337/) (2019)
- [The Impact of the U.S. Census Disclosure Avoidance System on Redistricting and Voting Rights Analysis](https://mlsanity.com/paper/2105.14197/) (2021)
- [Trajectory Recovery From Ash: User Privacy Is NOT Preserved in Aggregated Mobility Data](https://mlsanity.com/paper/1702.06270/) (2017)
- [Bayesian and Frequentist Semantics for Common Variations of Differential Privacy: Applications to the 2020 Census](https://mlsanity.com/paper/2209.03310/) (2022)
- [Routes for breaching and protecting genetic privacy](https://mlsanity.com/paper/1310.3197/) (2013)
- [A Simulated Reconstruction and Reidentification Attack on the 2010 U.S. Census](https://mlsanity.com/paper/2312.11283/) (2023)
- [A Note on the Misinterpretation of the US Census Re-identification Attack](https://mlsanity.com/paper/2202.04872/) (2022)
- [A Re-examination of the Census Bureau Reconstruction and Reidentification Attack](https://mlsanity.com/paper/2205.03939/) (2022)
- [Diffix Elm: Simple Diffix](https://mlsanity.com/paper/2201.04351/) (2022)

## Built on by (most cited first, 1 of 1)

- [A Consensus Privacy Metrics Framework for Synthetic Data](https://mlsanity.com/paper/2503.04980/) (2025)

## Abstract (arXiv)

The purpose of anonymizing structured data is to protect the privacy of individuals in the data while retaining the statistical properties of the data. There is a large body of work that examines anonymization vulnerabilities. Focusing on strong anonymization mechanisms, this paper examines a number of prominent attack papers and finds several problems, all of which lead to overstating risk. First, some papers fail to establish a correct statistical inference baseline (or any at all), leading to incorrect measures. Notably, the reconstruction attack from the US Census Bureau that led to a redesign of its disclosure method made this mistake. We propose the non-member framework, an improved method for how to compute a more accurate inference baseline, and give examples of its operation. Second, some papers don't use a realistic membership base rate, leading to incorrect precision measures if precision is reported. Third, some papers unnecessarily report measures in such a way that it is difficult or impossible to assess risk. Virtually the entire literature on membership inference attacks, dozens of papers, make one or both of these errors. We propose that membership inference papers report precision/recall values using a representative range of base rates.