# QueryCheetah: Fast Automated Discovery of Attribute Inference Attacks Against Query-Based Systems

arXiv: https://arxiv.org/abs/2409.01992 · HTML: https://mlsanity.com/paper/2409.01992/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 19 references that are in the map.
- First posted on arXiv 3 Sep 2024.

## Builds on (most cited first, 4 of 4)

- [Auditing Differentially Private Machine Learning: How Private is Private SGD?](https://mlsanity.com/paper/2006.07709/) (2020)
- [Detecting Violations of Differential Privacy](https://mlsanity.com/paper/1805.10277/) (2018)
- [CheckDP: An Automated and Integrated Approach for Proving Differential Privacy or Finding Precise Counterexamples](https://mlsanity.com/paper/2008.07485/) (2020)
- [QuerySnout: Automating the Discovery of Attribute Inference Attacks against Query-Based Systems](https://mlsanity.com/paper/2211.05249/) (2022)

## Built on by (most cited first, 3 of 3)

- [CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage](https://mlsanity.com/paper/2507.16872/) (2025)
- [DeSIA: Attribute Inference Attacks Against Limited Fixed Aggregate Statistics](https://mlsanity.com/paper/2504.18497/) (2025)
- [When T2I Synthetic Data Backfires: Amplified Privacy Risks in Real-Synthetic Mix Training](https://mlsanity.com/paper/2607.13541/) (2026)

## Abstract (arXiv)

Query-based systems (QBSs) are one of the key approaches for sharing data. QBSs allow analysts to request aggregate information from a private protected dataset. Attacks are a crucial part of ensuring QBSs are truly privacy-preserving. The development and testing of attacks is however very labor-intensive and unable to cope with the increasing complexity of systems. Automated approaches have been shown to be promising but are currently extremely computationally intensive, limiting their applicability in practice. We here propose QueryCheetah, a fast and effective method for automated discovery of privacy attacks against QBSs. We instantiate QueryCheetah on attribute inference attacks and show it to discover stronger attacks than previous methods while being 18 times faster than the state-of-the-art automated approach. We then show how QueryCheetah allows system developers to thoroughly evaluate the privacy risk, including for various attacker strengths and target individuals. We finally show how QueryCheetah can be used out-of-the-box to find attacks in larger syntaxes and workarounds around ad-hoc defenses.