FERMI: Exploiting Relations for Membership Inference Against Tabular Diffusion Models

TL;DR

FERMI enhances membership inference attacks on tabular diffusion models by leveraging relational data, significantly improving attack success rates in multi-relational settings.

Contribution

FERMI introduces a method to incorporate relational information into membership inference attacks, addressing a key gap in privacy risk assessment for multi-table data.

Findings

FERMI outperforms single-table baselines in attack success rates.

Attack performance improves by up to 53% TPR@0.1 FPR in white-box settings.

FERMI achieves a 22% increase in black-box attack effectiveness.

Abstract

Diffusion models are the leading approach for tabular data synthesis and are increasingly used to share sensitive records. Whether they actually protect privacy has become a pressing question. Membership inference attacks are the standard tool for this purpose, yet existing attacks assume a single-table setting and ignore the multi-relational structure of real sensitive data. A core challenge in assessing privacy risks from membership inference attacks in multi-table settings is how to leverage auxiliary information from relations associated with the target table, such as its parent tables. Particularly, we study a practical setting in which such auxiliary information is available only when training the attack model. At inference time, the attacker observes only the attribute values of the target record from the target table. We propose FERMI (FEature-mapping for Relational Membership Inference), which resolves this gap by enriching single-table features with relational membership signal. Across three tabular diffusion architectures and three real-world relational datasets, FERMI consistently improves attack performance over single-table baselines, with TPR@$0.1$FPR rising by up to 53% over the single-table baseline in the white-box setting and 22% in the black-box setting.