# An Understanding of the Vulnerability of Datasets to Disparate Membership Inference Attacks
## 3 Results of Vulnerability Classification
### In-Label Distance Measures  
In-label distance measures compute the distances between each observation within a class. This metric follows from insight found in work, such as that by [PERSON] and [PERSON] discussed above [20,21]. These measures first group observations by class and then determine the distances between each observation within the class using a _city block_, also known as a _Manhattan_, distance measurement as shown in Equation (3). This distance metric was utilized in agreement with [PERSON] et al. who found that this L1 norm metric provides better results in high dimensional datasets [71].  
\[d=\sum_{i=1}^{n}|x_{i}-y_{i} \tag{3}\]  
As discussed in the _Introduction_ and reiterated above, it is understood that sparse class boundaries can lead to vulnerabilities within a class, and this is a driving factor for disparate vulnerability. Therefore, it is reasonable that five of the seven top features are related to in-label distance measures for the disparate attack vulnerability-classification model.  
Table 6 provides a summary of the descriptive statistics for each of the included in-label distance features. It can be seen that, for the average of the label minimum, mean, and maximum distances, the distance is significantly higher for vulnerable datasets when compared to their non-vulnerable counterparts. Furthermore, included as significant features are the variance of the label minimum and mean distances, which were also significantly higher for vulnerable datasets. The variance of label distance features and the average of label minimum distances show the most divergence in the upper 50% of the data.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Feature** & **Descriptive Statistic** & **Full Dataset** & **Non-Vulnerable** & **Vulnerable** \\ \hline \multirow{6}{*}{**Average of Label**} & **Mean** & 19.85 & 0.62 & 48.80 \\ \cline{2-5}  & **Standard Deviation** & 41.13 & 5.41 & 52.95 \\ \cline{2-5}  & **Minimum** & 0.00 & 0.00 & 0.00 \\ \cline{2-5}  & **25\% Quartile** & 0.00 & 0.00 & 0.00 \\ \cline{2-5}  & **50\% Quartile** & 0.00 & 0.00 & 4.15 \\ \cline{2-5}  & **75\% Quartile** & 2.00 & 0.07 & 111.35 \\ \cline{2-5}  & **Maximum** & 111.35 & 103.22 & 111.35 \\ \hline \multirow{6}{*}{**Variance of Label**} & **Mean** & 260.81 & 5.76 & 644.85 \\ \cline{2-5}  & **Standard Deviation** & 552.29 & 91.81 & 711.89 \\ \cline{2-5}  & **Minimum** & 0.00 & 0.00 & 0.00 \\ \cline{2-5}  & **25\% Quartile** & 0.00 & 0.00 & 0.00 \\ \cline{2-5}  & **50\% Quartile** & 0.00 & 0.00 & 0.19 \\ \cline{2-5}  & **75\% Quartile** & 0.01 & 0.00 & 1409.65 \\ \cline{2-5}  & **Maximum** & 1536.01 & 1536.01 & 1536.01 \\ \hline \multirow{6}{*}{**Variance of Label**} & **Mean** & 293.26 & 9.08 & 721.16 \\ \cline{2-5}  & **Standard Deviation** & 621.88 & 121.66 & 801.77 \\ \cline{2-5}  & **Minimum** & 0.00 & 0.00 & 0.00 \\ \cline{2-5}  & **25\% Quartile** & 0.47 & 0.22 & 1.11 \\ \cline{2-5}  & **50\% Quartile** & 1.11 & 1.11 & 8.16 \\ \cline{2-5}  & **75\% Quartile** & 8.16 & 1.11 & 1521.40 \\ \cline{2-5}  & **Maximum** & 2282.77 & 2282.77 & 2282.77 \\ \hline \multirow{6}{*}{**Average of Label Mean**} & **Mean** & 41.39 & 8.04 & 91.60 \\ \cline{2-5}  & **Standard Deviation** & 70.95 & 12.02 & 90.60 \\ \cline{2-5}  & **Minimum** & 0.26 & 0.26 & 0.65 \\ \cline{2-5}  & **Label Mean** & **25\% Quartile** & 7.15 & 4.20 & 8.73 \\ \cline{2-5}  & **50\% Quartile** & 8.73 & 8.73 & 10.81 \\ \cline{2-5}  & **75\% Quartile** & 10.92 & 8.73 & 191.09 \\ \cline{2-5}  & **Maximum** & 191.51 & 191.51 & 191.51 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Descriptive statistics of the in-label distance measure features for the overall dataset, the non-vulnerable observations, and the vulnerable observations.