A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data

TL;DR

This paper introduces a novel zero auxiliary knowledge membership inference attack on aggregate location data, demonstrating its effectiveness even under privacy protections and with limited adversary knowledge.

Contribution

The authors develop the first synthetic-based MIA that does not require auxiliary data, showing its effectiveness against privacy mechanisms like differential privacy.

Findings

ZK MIA matches state-of-the-art KK MIA performance.

ZK MIA remains effective with only 10% knowledge of target data.

Effective MIAs highlight the need for stronger privacy protections.

Abstract

Location data is frequently collected from populations and shared in aggregate form to guide policy and decision making. However, the prevalence of aggregated data also raises the privacy concern of membership inference attacks (MIAs). MIAs infer whether an individual's data contributed to the aggregate release. Although effective MIAs have been developed for aggregate location data, these require access to an extensive auxiliary dataset of individual traces over the same locations, which are collected from a similar population. This assumption is often impractical given common privacy practices surrounding location data. To measure the risk of an MIA performed by a realistic adversary, we develop the first Zero Auxiliary Knowledge (ZK) MIA on aggregate location data, which eliminates the need for an auxiliary dataset of real individual traces. Instead, we develop a novel synthetic approach, such that suitable synthetic traces are generated from the released aggregate. We also develop methods to correct for bias and noise, to show that our synthetic-based attack is still applicable when privacy mechanisms are applied prior to release. Using two large-scale location datasets, we demonstrate that our ZK MIA matches the state-of-the-art Knock-Knock (KK) MIA across a wide range of settings, including popular implementations of differential privacy (DP) and suppression of small counts. Furthermore, we show that ZK MIA remains highly effective even when the adversary only knows a small fraction (10%) of their target's location history. This demonstrates that effective MIAs can be performed by realistic adversaries, highlighting the need for strong DP protection.