A Bayesian Approach to Membership Inference for Statistical Release

Image generated by AI

TLDR

• What: A modular Bayesian Membership Inference Attack (BMIA) framework that models population attribute dependencies as a Bayesian Network and computes the exact posterior probability of membership via probabilistic programming.
• Who's at risk: Publicly released aggregate statistics and marginals derived from databases with highly correlated attributes (e.g., US Census demographic releases, IRS statistics, clinical symptom tables, or academic database dumps).
• Key number: On the highly correlated Sachs protein-signaling dataset, the BMIA achieves an Area Under the Curve (AUC) of 0.906, outperforming the standard Likelihood Ratio Test (0.851) by 5.5% and the Inner Product attack (0.824) by 8.2%.

Real-world demographic, financial, and medical data almost never follow a clean, independent product distribution; instead, they contain complex, multi-layered structural relationships. Traditional membership inference attacks (MIAs) on statistical releases, such as those analyzed for Google's aggregate trends or US Census releases, rely on population marginals and assume independent attributes. Oakley et al. (arXiv 2026) show that by modeling these structural dependencies as a Bayesian Network, an attacker can launch specialized, highly accurate attacks that easily bypass standard independence-based privacy protections.

Background / Problem Setup

In a standard membership inference setup on statistical releases, a defender publishes the sample means $\bar{\mathbf{x}} = \frac{1}{n} \sum_{i=1}^n \mathbf{x}^{(i)}$ of a private dataset $D$. The attacker's objective is to determine if a target individual $\mathbf{y}$ is a member of $D$.

Classical attacks, such as the Likelihood Ratio Test (LRT) and the Inner Product (IP) attack, assume that attributes are independent (a product distribution). Under strong attribute correlation, these independent assumptions fail, causing standard attacks to suffer from signal amplification or dilution. While manual "clipping" can patch these attacks for simple toy dependencies (such as duplicate features), it cannot scale to realistic populations with intricate dependency structures.

Methodology

Oakley et al. (arXiv 2026) formulate the attack by modeling the population distribution as a Bayesian Network, $BN(\mathcal{P})$. Instead of calculating approximations from independent marginals, the attacker computes the exact Bayesian decision ratio $R$:

To compute this posterior exactly and avoid the variance pitfalls of Monte Carlo sampling, the authors leverage the state-of-the-art probabilistic programming language (PPL) Roulette (Moy et al., PLDI 2025). Roulette uses exact knowledge compilation to calculate the exact normalizing constant, resolving the conditional probabilities cleanly.

The BMIA Posterior Program

As formalized in Section 4.1, the posterior computation is executed as a probabilistic program:

# Conceptual representation of Algorithm 1
def compute_posterior(BN_P, x_bar, y, n):
    # 1. Initialize membership prior as a fair coin flip
    l_IN = flip(0.5)
    
    # 2. Instantiate n independent Bayesian networks for the population
    x = []
    for i in range(n):
        x.append(sample_from_network(BN_P))
    
    # 3. Condition based on the membership flag l_IN
    if l_IN:
        # If member: one record is the target y, remaining n-1 are from P
        observe(y + sum(x[0:n-1]) == x_bar * n)
    else:
        # If non-member: all n records are drawn i.i.d. from P
        observe(sum(x[0:n]) == x_bar * n)
        
    return l_IN

Through Theorems 1, 2, and 3, Oakley et al. (arXiv 2026) prove that when the population follows a product distribution, BMIA simplifies to the classical LRT. More importantly, when applied to populations with repeated or left/right duplicated features (Figures 3a and 3b), BMIA mathematically recovers the optimal manually clipped LRT variant without requiring any human intervention.

Key Results

The authors evaluated the attack across five standard benchmarking Bayesian Networks from the bnlearn repository. The target datasets were generated with $n < d$ to maintain enough signal for attack viability.

Strong Threat Model Performance

Table 1 in the paper details the AUC achieved by the attacks under the Strong Threat Model (where the attacker has complete access to the true network structure and probability tables):

Weak vs. Weakest Threat Models

To test realistic scenarios where the attacker does not have the exact probability tables, the authors evaluated Weak (structure known, probabilities estimated via MLE from $m$ samples) and Weakest (structure and probabilities learned via the PC algorithm from $m$ samples) threat models on the Asia network. Figure 5 demonstrates these results:

Even when the structural dependency is completely unknown and learned from a tiny auxiliary dataset of just $10$ samples, BMIA achieves an AUC of 0.770, dramatically outperforming both standard LRT (0.689) and IP (0.674).

Limitations & Open Questions

• Exact Inference Scalability: As Section 6.5 and Figure 8b illustrate, exact compilation in Roulette scales poorly when the number of records $n$ increases on highly connected networks. For the Sachs network, runtime escalates sharply once $n \geq 5$. Exploring approximate inference methods (like Markov Chain Monte Carlo) is necessary for larger datasets, though this introduces sampling approximation errors.
• Continuous Features: The current formulation is restricted to discrete/binary domains. While continuous attributes can be bucketed or modeled with continuous Bayesian Networks, this discretization can degrade the precision of the dependency representation.
• Defensive Mitigation: While the authors discuss Differential Privacy (DP) as a defense, they do not provide empirical benchmarks showing how much privacy budget ($\epsilon$, $\delta$) is required to completely nullify the advantage of a structure-aware Bayesian attacker.

What Practitioners Should Do

1. Mandate Differential Privacy (DP) for Aggregate Releases: Do not rely on "large" sample sizes or simple attribute counts for security. Run your aggregate releases through a DP library (like Google's differential-privacy or OpenDP) to add calibrated noise to the marginals before publishing.
2. Audit Publications with Structure-Learning Tools: Before releasing aggregate statistics, use Python packages like pgmpy or bnlearn to run structure-learning algorithms on your private dataset. If the algorithms find strong, dense causal relationships (high-dimension, highly connected DAGs), classical marginal-based risk assessments will severely underestimate your leakage.
3. Control the Dimensionality-to-Sample-Size Ratio: BMIA is most effective when the number of released attributes $d$ is greater than the sample size $n$ ($n < d$). If you cannot apply DP, artificially restrict the number of public marginals you publish from a single cohort.
4. Conduct Bayesian Red-Teaming: Use PPL environments (such as Stan, Pyro, or Roulette) to simulate BMIA attacks on your data releases during privacy audits. If the simulated Bayesian attacker achieves an AUC $> 0.65$, block the release.

The Takeaway

Oakley et al. (arXiv 2026) prove that assuming attribute independence under-represents the true danger of membership inference. By capturing population dependencies as a Bayesian Network, attackers can automatically exploit hidden information, proving that organizations must move beyond classical, marginal-only safety audits to guarantee robust data privacy.

Den's Take

This paper exposes a critical blind spot in how we think about "safe" aggregate data releases. As security practitioners, we've long relied on the assumption that publishing simple sample means or marginals protects individual privacy. Oakley et al. obliterate this assumption by proving that when you model actual real-world correlations using Bayesian Networks, you can easily bypass classical independent-based defenses.

This isn't just an academic exercise. Imagine a healthcare consortium releasing "de-identified" aggregate patient metrics to secure a $15M clinical research partnership, only to have malicious actors reconstruct the membership of high-risk patients using public auxiliary datasets. The moment structural dependencies are ignored, "anonymization" becomes a farce.

This systematic leakage of membership information is highly reminiscent of the vulnerabilities we see in modern AI deployments. While Oakley et al. focus on classical statistical tables, the underlying threat of structural inference mirrors our findings in Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment. In that work, we demonstrated how enterprise RAG systems leak whether specific proprietary documents were used in the retrieval database with incredibly high efficiency, proving that whether it is classical Bayesian modeling or modern vector databases, membership privacy remains incredibly fragile.