# Learning to Attack: Uncovering Privacy Risks in Sequential Data Releases

arXiv: https://arxiv.org/abs/2510.24807 · HTML: https://mlsanity.com/paper/2510.24807/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 76 references that are in the map.
- First posted on arXiv 28 Oct 2025.

## Builds on (most cited first, 24 of 24)

- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Extracting Training Data from Diffusion Models](https://mlsanity.com/paper/2301.13188/) (2023)
- [SeqGAN: Sequence Generative Adversarial Nets with Policy Gradient](https://mlsanity.com/paper/1609.05473/) (2016)
- [Federated Learning: Opportunities and Challenges](https://mlsanity.com/paper/2101.05428/) (2021)
- [Knock Knock, Who's There? Membership Inference on Aggregate Location Data](https://mlsanity.com/paper/1708.06145/) (2017)
- [DiffTraj: Generating GPS Trajectory with Diffusion Probabilistic Model](https://mlsanity.com/paper/2304.11582/) (2023)
- [ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods](https://mlsanity.com/paper/2406.15968/) (2024)
- [Differentially Private Secure Multi-Party Computation for Federated Learning in Financial Applications](https://mlsanity.com/paper/2010.05867/) (2020)
- [LSTM-TrajGAN: A Deep Learning Approach to Trajectory Privacy Protection](https://mlsanity.com/paper/2006.10521/) (2020)
- [Membership Inference Attacks Against Recommender Systems](https://mlsanity.com/paper/2109.08045/) (2021)
- [ControlTraj: Controllable Trajectory Generation with Topology-Constrained Diffusion Model](https://mlsanity.com/paper/2404.15380/) (2024)
- [Privacy in Social Media: Identification, Mitigation and Applications](https://mlsanity.com/paper/1808.02191/) (2018)
- [Privacy-Preserving Synthetic Educational Data Generation](https://mlsanity.com/paper/2207.03202/) (2022)
- [Quantifying Differential Privacy under Temporal Correlations](https://mlsanity.com/paper/1610.07543/) (2016)
- [Reconstruction Attack on Differential Private Trajectory Protection Mechanisms](https://mlsanity.com/paper/2210.09375/) (2022)
- [Real-Time Trajectory Synthesis with Local Differential Privacy](https://mlsanity.com/paper/2404.11450/) (2024)
- [Frequency-based Randomization for Guaranteeing Differential Privacy in Spatial Trajectories](https://mlsanity.com/paper/2207.03722/) (2022)
- [Adversary for Social Good: Leveraging Adversarial Attacks to Protect Personal Attribute Privacy](https://mlsanity.com/paper/2306.02488/) (2023)
- [A Trajectory K-Anonymity Model Based on Point Density and Partition](https://mlsanity.com/paper/2307.16849/) (2023)
- [Protecting Spatiotemporal Event Privacy in Continuous Location-Based Services](https://mlsanity.com/paper/1907.10814/) (2019)
- [Protecting Data Buyer Privacy in Data Markets](https://mlsanity.com/paper/2407.09771/) (2024)
- [Towards Privacy-Preserving Data-Driven Education: The Potential of Federated Learning](https://mlsanity.com/paper/2503.13550/) (2025)
- [On Membership Inference Attacks in Knowledge Distillation](https://mlsanity.com/paper/2505.11837/) (2025)

## Built on by (most cited first, 1 of 1)

- [Privacy-Preserving EHR Data Transformation via Geometric Operators: A Human-AI Co-Design Technical Report](https://mlsanity.com/paper/2603.22954/) (2026)

## Abstract (arXiv)

Privacy concerns have become increasingly critical in modern AI and data science applications, where sensitive information is collected, analyzed, and shared across diverse domains such as healthcare, finance, and mobility. While prior research has focused on protecting privacy in a single data release, many real-world systems operate under sequential or continuous data publishing, where the same or related data are released over time. Such sequential disclosures introduce new vulnerabilities, as temporal correlations across releases may enable adversaries to infer sensitive information that remains hidden in any individual release. In this paper, we investigate whether an attacker can compromise privacy in sequential data releases by exploiting dependencies between consecutive publications, even when each individual release satisfies standard privacy guarantees. To this end, we propose a novel attack model that captures these sequential dependencies by integrating a Hidden Markov Model with a reinforcement learning-based bi-directional inference mechanism. This enables the attacker to leverage both earlier and later observations in the sequence to infer private information. We instantiate our framework in the context of trajectory data, demonstrating how an adversary can recover sensitive locations from sequential mobility datasets. Extensive experiments on Geolife, Porto Taxi, and SynMob datasets show that our model consistently outperforms baseline approaches that treat each release independently. The results reveal a fundamental privacy risk inherent to sequential data publishing, where individually protected releases can collectively leak sensitive information when analyzed temporally. These findings underscore the need for new privacy-preserving frameworks that explicitly model temporal dependencies, such as time-aware differential privacy or sequential data obfuscation strategies.