Title: Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy
Venue: NeurIPS 2025
Accepted: yes
Keywords: differential privacy

privacy risk

re-identification

singling out

attribute inference

data reconstruction

machine learning
Abstract: Differentially private (DP) mechanisms are difficult to interpret and calibrate because existing methods for mapping standard privacy parameters to concrete privacy risks—re-identification, attribute inference, and data reconstruction—are both overly pessimistic and inconsistent. In this work, we use the hypothesis-testing interpretation of DP ($f$-DP), and determine that bounds on attack success can take the same unified form across re-identification, attribute inference, and data reconstruction risks. Our unified bounds are (1) consistent across a multitude of attack settings, and (2) tunable, enabling practitioners to evaluate risk with respect to arbitrary, including worst-case, levels of baseline risk. Empirically, our results are tighter than prior methods using $\varepsilon$-DP, R\'enyi DP, and concentrated DP. As a result, calibrating noise using our bounds can reduce the required noise by 20% at the same risk level, which yields, e.g., an accuracy increase from 52% to 70% in a text classification task. Overall, this unifying perspective provides a principled framework for interpreting and calibrating the degree of protection in DP against specific levels of re-identification, attribute inference, or data reconstruction risk.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a framework for interpreting and calibrating DP guarantees in terms of concrete privacy risks. The main contribution is the use of the $f$-DP formalism to derive a single, unified bound on the success of re-identification, attribute inference, and data reconstruction attacks. The authors propose that for all three risks, the attack success probability is bounded by the formula $\\text{succ} \\le 1 - f(\\text{base})$, where $\\text{base}$ is the adversary's maximum success probability without the mechanism's output. The paper argues that this unifying framework provides bounds that are 1) consistent across risks, 2) tunable to specific baseline threats, and 3) empirically tighter than prior methods, which further allows for better utility.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- An elegant and theoretically principled way to tightly bound different privacy risks\n- Promising empirical results\n\n**Weaknesses**\n\nDespite its strong core idea, the paper falls short in several important issues:\n- **Insufficient positioning and comparison to state-of-the-art.**  \n  - The paper fails to position its conceptual contribution with respect to prior work on risk-based calibration. The general idea of calibrating DP noise to a desired level of operational risk has been explored previously, in particular in [1]. While the current work uses the method from that paper as a tool, it fails to discuss the conceptual overlap and clarify what novel contributions it offers to the idea of attack-aware calibration itself.\n  - The paper's central claim of providing \"*tighter estimates of risk compared to prior methods*\" is not backed by comparisons with the state-of-the-art for each specific risk. Most notably, for data reconstruction attacks under DP-SGD, the paper compares its bounds to Balle et al. (2022) but omits the more recent work [1], which provides nearly matching upper and lower bounds on reconstruction, suggesting their bound is already very tight. Without a direct comparison, it is impossible to assess if this paper's bound offers a meaningful improvement over the best-known specialized bound. \n  - I don't think unification is a primary contribution of this paper. To me this is just a direct and unsurprising consequence of defining all risks within the same strong-adversary threat model native to DP. Even a single $(\\varepsilon, \\delta)$-DP guarantee can be translated into an unified upper bound ($\\frac{e^{\\varepsilon}+\\delta}{e^{\\varepsilon}+1}$). Therefore, the novelty does not lie in the unification itself, but rather in the use of $f$-DP to achieve tighter bounds. \n- **Lack of motivation for the $f$-DP framework.**  The paper fails to adequately explain why the $f$-DP framework is more powerful and capable of producing tighter bounds. A critical point (in my view) is that a single $(\\varepsilon, \\delta)$ pair is an incomplete characterization of a mechanism's privacy guarantees. By compressing a full privacy profile into one point, prior analyses lose information, leading to looser bounds. This is in contrast to the $f$-DP framework based on the trade-off curve, which provides a complete characterization. This motivation is critical and should be a more central part of the paper's narrative.\n- **Overstatement.**  The authors overstate the generality of their results by claiming that \"*By bounding the success of the strong adversary, we automatically bound the success of attacks under any other threat model that is weaker or more realistic*\". This claim is only valid for threat models that are strict subsets of the strong adversary model. However, many practical privacy risks, such as training data extraction (or verbatim memorization) from language models, operate under entirely different adversarial assumptions; DP and $f$-DP might not easily translate to an upper bound for these attacks (see [2]). These threat models are not necessarily \"weaker\", but rather orthogonal. The paper should be more precise and qualify its claims, acknowledging that its framework provides tight bounds for risks that can be framed as a hypothesis test within the strong adversary model, but may not address other important, practical privacy risks that fall outside this specific formulation.\n- **Clarity of presentation and notation.** The paper's notation is dense and its definitions of risk are difficult to parse without significant effort. The concept of \"baseline success\" is not built up with sufficient intuition in the main body. For the work to be broadly accessible and impactful, a clearer, more streamlined presentation is needed to explain what the baseline represents and how a practitioner should reason about it.\n\n\n**References**\n\n[1] Kulynych, Bogdan, et al. \"Attack-aware noise calibration for differential privacy.\" Advances in Neural Information Processing Systems 37 (2024): 134868-134901.\n\n[2] Hayes, Jamie, Borja Balle, and Saeed Mahloujifar. \"Bounding training data reconstruction in dp-sgd.\" Advances in neural information processing systems 36 (2023): 78696-78722.\n\n[3] Hu, Yuzheng, et al. \"Empirical Privacy Variance.\" arXiv preprint arXiv:2503.12314 (2025).\n\nQUESTIONS:\nN/A\n\nLIMITATIONS:\nNo, the authors did not discuss the limitations of their work. I believe the authors should acknowledge that the bound is only applicable to risks that can be framed as a hypothesis test within the strong adversary model, but may not address other important and practical privacy risks that arise in modern machine learning.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-13"}

comments: SUMMARY:
A problem when evaluating the privacy risks is that there is not a unified privacy risk calibrating framework for different type of threats, i.e., re-identification, attribute inference, etc. In this paper, the authors borrow f-dp to build an unified privacy-risk evaluation framework for these risks.

STRENGTHS AND WEAKNESSES:
Strength:

1. The problem itself is interesting.


Weakness:

1. The presentation is not clear enough to follow. For instance, in figure 1, what does $\frac{\text{re-identification}}{\text{attribute inference}}$ mean? Does it mean re-identification \textbf{or} attribute inference? And what does the f(x) mean in this figure?

I also recommend the author present a notation table to unify the symbols used in the paper.

2. Please convince me the practical reason and need of unifying the different type of risks. To my understanding, membership inference attacks, which are the most easy attacks, is proper to evaluate the privacy risks. For instance, other high-level attacks, e.g., inversion attacks, are harder to apply than membership inference attacks if the adversary has the same level of ability. In this case, if we observe an low membership inference, other type of risks should be smaller. We only need to bound the membership inference risks, why we need to bound other type of risks?

QUESTIONS:
To my understanding, you design a new risks bounding mechanism which takes the noises, algorithms, baseline success rate as inputs and outputs the theoretical attacking advantage. Is my understanding correct?

LIMITATIONS:
No
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-29

comments: SUMMARY:
This paper derives an upper bound on the success probability of any strong adversary against an $f$-DP mechanism. The bound is general—applicable to reconstruction, attribution, and other attack types—and is expressed relative to a chosen baseline. This formulation offers flexibility: for high-risk models one can adopt a universal worst-case baseline, while for lower-risk settings a more specific baseline yields a tighter bound. Empirically, the authors demonstrate that their bound strictly improves on existing Rényi-DP-based bounds for reconstruction attacks.

STRENGTHS AND WEAKNESSES:
**Strengths**

- The proposed upper bound sheds light on how to DP parameters to defend against specific privacy attacks, a key obstacle to the practical adoption of differential privacy.
- The authors derive an upper bound on any adversary’s success rate and demonstrate that this bound is tighter than existing reconstruction‐attack bounds. 

**Weaknesses**

- The f-DP bound may not extend straightforwardly to mechanisms beyond simple Laplace or Gaussian noise; for example, its tightness under composition (as in DP-SGD) is unclear.
- Although the bound gains flexibility by depending on a baseline attack, how to select an appropriate baseline remains an open question.

QUESTIONS:
Can the authors please elaborate on whether the proposed baseline‐dependent bound can be used to empirically audit differential privacy, and if so, how this would be carried out?

Additionally, in many settings, the f function relies on numerical procedure to compute and does not have close form solution, does that affect the interpretation of the results?

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 2
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposed an unified view for the success of reconstruction/re-identification/attribute inference attacks through f-DP. The key technical insight is that the properties of f-DP, most importantly post-processing and convexity of the trade-off function, can be used to form a single upper bound on the success of all the aforementioned attacks based on the attacker's baseline success probability. Authors show numerically that the proposed bound provides a more meaningful upper bound than the earlier works.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n- Deriving tight translations of DP (or f-DP guarantees) to attacks other than membership inference is an important task. With a better characterization of the privacy threats, analyst can better calibrate their noise levels for the private release. As an example of this, authors demonstrate how you can obtain the same operational privacy risk but with significantly reduced noise compared to the prior work. (**Significance + Originality**)\n- The proposed theorems give simple expressions for upper bound for the attack success, only dependent on the baseline vulnerabilities. (**Clarity + Quality**)\n\n## Weaknesses\n- Some empirical experiments on attacks would have strengthened the paper, allowing the reader to better understand the gap between the upper bounds and actual real-world risks. (**Significance**)\n\nQUESTIONS:\n1. Authors could further discuss the connection on the attacks to the DP threat model. In the various security definitions, the unknown sample $z$ is averaged over, while in DP threat model we consider the threat as the supremum of the privacy loss over the $z$. This might make it easier to see the exact connection between the protection against MIA that (f-)DP provides and the threats considered in the attacks.\n2. Authors could add a more detailed description of the singling-out attack. It is somewhat difficult to parse from Definition 3.1., so some general description would make it easier to follow.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}