@inproceedings{
busa-fekete2024auditing,
title={Auditing Privacy Mechanisms via Label Inference Attacks},
author={Robert Istvan Busa-Fekete and Travis Dick and Claudio Gentile and Andres Munoz medina and Adam Smith and Marika Swanberg},
booktitle={The Thirty-eighth Annual Conference on Neural Information Processing Systems},
year={2024},
url={https://openreview.net/forum?id=Ai76ATrb2y}
}
We propose reconstruction advantage measures to audit label privatization mechanisms. A reconstruction advantage measure quantifies the increase in an attacker's ability to infer the true label of an unlabeled example when provided with a private version of the labels in a dataset (e.g., aggregate of labels from different users or noisy labels output by randomized response), compared to an attacker that only observes the feature vectors, but may have prior knowledge of the correlation between features and labels. We consider two such auditing measures: one additive, and on multiplicative. These cover previous approaches taken in the literature on empirical auditing and differential privacy. These measures allow us to place a variety of proposed privatization schemes---some differentially private, some not---on the same footing. We analyze these measures theoretically under a distributional model which, we claim, encapsulates reasonable adversarial settings. We also quantify their behavior empirically on real and simulated  prediction tasks. Across a range of experimental settings, we find that differentially private schemes dominate or match the privacy-utility tradeoff of more heuristic approaches.
Auditing Privacy Mechanisms via Label Inference Attacks
Robert Istvan Busa-Fekete Travis Dick Claudio Gentile Andres Munoz medina Adam Smith Marika Swanberg