# A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data

arXiv: https://arxiv.org/abs/2406.18671 · HTML: https://mlsanity.com/paper/2406.18671/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 16 of its 74 references that are in the map.
- First posted on arXiv 26 Jun 2024.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 16 of 16)

- [ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models](https://mlsanity.com/paper/1806.01246/) (2018)
- [Auditing Differentially Private Machine Learning: How Private is Private SGD?](https://mlsanity.com/paper/2006.07709/) (2020)
- [Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning](https://mlsanity.com/paper/2101.04535/) (2021)
- [Synthetic Data -- Anonymisation Groundhog Day](https://mlsanity.com/paper/2011.07018/) (2020)
- [Knock Knock, Who's There? Membership Inference on Aggregate Location Data](https://mlsanity.com/paper/1708.06145/) (2017)
- [TAPAS: a Toolbox for Adversarial Privacy Auditing of Synthetic Data](https://mlsanity.com/paper/2211.06550/) (2022)
- [Investigating Membership Inference Attacks under Data Dependencies](https://mlsanity.com/paper/2010.12112/) (2020)
- [Achilles' Heels: Vulnerable Record Identification in Synthetic Data Publishing](https://mlsanity.com/paper/2306.10308/) (2023)
- [Synthetic is all you need: removing the auxiliary data assumption for membership inference attacks against synthetic data](https://mlsanity.com/paper/2307.01701/) (2023)
- [When the signal is in the noise: Exploiting Diffix's Sticky Noise](https://mlsanity.com/paper/1804.06752/) (2018)
- [Generative Models for Simulating Mobility Trajectories](https://mlsanity.com/paper/1811.12801/) (2018)
- [Measuring Membership Privacy on Aggregate Location Time-Series](https://mlsanity.com/paper/1902.07456/) (2019)
- [Correlation inference attacks against machine learning models](https://mlsanity.com/paper/2112.08806/) (2021)
- [QuerySnout: Automating the Discovery of Attribute Inference Attacks against Query-Based Systems](https://mlsanity.com/paper/2211.05249/) (2022)
- [The NetMob23 Dataset: A High-resolution Multi-region Service-level Mobile Data Traffic Cartography](https://mlsanity.com/paper/2305.06933/) (2023)
- [Privacy Guarantees for Personal Mobility Data in Humanitarian Response](https://mlsanity.com/paper/2306.09471/) (2023)

## Built on by (most cited first, 4 of 4)

- [A Dual Perspective on Synthetic Trajectory Generators: Utility Framework and Privacy Vulnerabilities](https://mlsanity.com/paper/2604.19653/) (2026)
- [Demystifying Trajectory Recovery From Ash: An Open-Source Evaluation and Enhancement](https://mlsanity.com/paper/2409.14645/) (2024)
- [Sub-optimal Learning in Meta-Classifier Attacks: A Study of Membership Inference on Differentially Private Location Aggregates](https://mlsanity.com/paper/2412.20456/) (2024)
- [Attribute Inference from Interactive Targeted Ads](https://mlsanity.com/paper/2606.15209/) (2026)

## Abstract (arXiv)

Location data is frequently collected from populations and shared in aggregate form to guide policy and decision making. However, the prevalence of aggregated data also raises the privacy concern of membership inference attacks (MIAs). MIAs infer whether an individual's data contributed to the aggregate release. Although effective MIAs have been developed for aggregate location data, these require access to an extensive auxiliary dataset of individual traces over the same locations, which are collected from a similar population. This assumption is often impractical given common privacy practices surrounding location data. To measure the risk of an MIA performed by a realistic adversary, we develop the first Zero Auxiliary Knowledge (ZK) MIA on aggregate location data, which eliminates the need for an auxiliary dataset of real individual traces. Instead, we develop a novel synthetic approach, such that suitable synthetic traces are generated from the released aggregate. We also develop methods to correct for bias and noise, to show that our synthetic-based attack is still applicable when privacy mechanisms are applied prior to release. Using two large-scale location datasets, we demonstrate that our ZK MIA matches the state-of-the-art Knock-Knock (KK) MIA across a wide range of settings, including popular implementations of differential privacy (DP) and suppression of small counts. Furthermore, we show that ZK MIA remains highly effective even when the adversary only knows a small fraction (10%) of their target's location history. This demonstrates that effective MIAs can be performed by realistic adversaries, highlighting the need for strong DP protection.