Attribute-Value Reconstruction Game

• Attribute-value reconstruction game is a formal framework that evaluates whether synthetic data releases leak an individual's sensitive attribute by randomizing a target record and applying linear reconstruction attacks.
• It employs a privacy experiment where a target’s secret attribute is perturbed and adversaries use quasi-identifiers and synthetic data to attempt exact reconstruction, isolating individual leakage from population-level correlations.
• The framework integrates utility metrics, such as 3-way marginal errors and ROC accuracy, to analyze privacy-utility trade-offs and assess differential privacy mitigations.

Searching arXiv for the cited papers and closely related work. (Annamalai et al., 2023) arXiv attribute inference synthetic data

An attribute-value reconstruction game is a formal framework for evaluating whether synthetic data leaks the hidden value of a sensitive attribute for a specific individual. In the sense introduced for synthetic data privacy, the game combines a privacy experiment with a linear reconstruction attack: a challenger randomizes one target record’s secret attribute, generates a synthetic dataset from the modified table, and an adversary attempts to reconstruct the randomized attribute value using the synthetic release together with the quasi-identifiers of the dataset (Annamalai et al., 2023). The construction is designed so that any success substantially above random guessing indicates individual-level leakage rather than population-level inference. In a distinct, broader game-theoretic usage, the phrase can also denote sequential value-assignment games such as e-Valuate, where one player chooses values and the other assigns them to variables or graph elements, with the outcome determined by a scalar evaluation function (Aravamuthan et al., 2012).

1. Formal object and threat model

The synthetic-data formulation begins with a tabular dataset

$\mathcal{D} = \{X \mid \mathbf{y}\},$

where there are $n$ records and $d$ attributes, $X$ is the $(d-1)$-column matrix of quasi-identifiers, and $\mathbf{y} \in \{0,1\}^n$ is the vector of secret attribute values. The data domain is discrete, $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$, and the secret attribute is assumed, without loss of generality, to be the $d$-th attribute. A synthetic data generator outputs

$\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$

where $m$ is the number of synthetic records and $n$0 has the same schema and domain as the original data (Annamalai et al., 2023).

The framework is explicitly about attribute inference rather than membership inference. Membership inference asks whether a record was in training data, whereas attribute inference asks: given a target’s quasi-identifiers $n$1, what is the target’s secret attribute $n$2? The setting is no-box: only the synthetic dataset is exposed, not the trained model or its hyperparameters. The adversary is partially informed. It knows the quasi-identifiers of all records in the original dataset $n$3, the target’s quasi-identifiers $n$4, the synthetic dataset $n$5, the dataset size $n$6, the synthetic size $n$7, the schema, and the domains; it does not know $n$8, the randomized secret vector $n$9, or the SDG mechanism and its parameters (Annamalai et al., 2023).

This threat model is calibrated to isolate leakage specific to a participating record. Prior attribute inference attacks on synthetic data were reported to have a base-rate problem: they could succeed even when the target was not actually in the dataset, because they exploited population-level correlations. The attribute-value reconstruction game is structured to remove that confounder.

2. Privacy experiment and winning condition

The challenger first samples an original dataset $d$0 with $d$1 records. It then selects a random target record $d$2 such that the target’s quasi-identifiers are unique in $d$3: $d$4 This models a re-identification scenario in which the target is uniquely identifiable from quasi-identifiers (Annamalai et al., 2023).

The defining step is individual-level perturbation of the secret attribute. The challenger constructs a target dataset

$d$5

such that

$d$6

Only the target’s secret attribute is replaced by a fresh random bit. Conditioned on the public information, the prior probability that $d$7 is therefore $d$8. The challenger then generates

$d$9

and gives the adversary $X$0, $X$1, and the full quasi-identifier matrix $X$2 (Annamalai et al., 2023).

The adversary outputs a guess

$X$3

and wins if

$X$4

Performance is measured by per-record accuracy and ROC curves over repeated executions. The accuracy of an attack $X$5 is

$X$6

with probability taken over sampling of $X$7, selection of $X$8, randomization of $X$9, the randomness of the SDG mechanism, and any adversarial randomness. Since the target bit is a fair coin, the natural baseline is $(d-1)$0, and the corresponding advantage is

$(d-1)$1

In the reported experiments, the best attacks achieve accuracy up to $(d-1)$2, corresponding to an advantage of $(d-1)$3 (Annamalai et al., 2023).

The intended privacy notion is empirical and operational: an SDG protects against attribute inference in this game if, for any efficient adversary, the success probability stays close to $(d-1)$4. Because all adversary-visible information other than $(d-1)$5 is independent of the randomized target bit, any significant advantage is interpreted as individual-level information leakage.

3. Linear reconstruction attack

The attack instantiated in the game is a linear reconstruction attack adapted from aggregate-statistics reconstruction to the synthetic data setting. It targets not merely the chosen record but the entire secret vector $(d-1)$6, and then extracts the target component. The core observation is that the adversary knows $(d-1)$7, and can therefore turn synthetic measurements of conditional frequencies into noisy estimates of marginals involving the secret attribute (Annamalai et al., 2023).

The attack uses $(d-1)$8-way marginal queries. For a subset $(d-1)$9 with $\mathbf{y} \in \{0,1\}^n$0 and a tuple $\mathbf{y} \in \{0,1\}^n$1, define

$\mathbf{y} \in \{0,1\}^n$2

and

$\mathbf{y} \in \{0,1\}^n$3

The adversary constructs a set of queries $\mathbf{y} \in \{0,1\}^n$4 in which each $\mathbf{y} \in \{0,1\}^n$5 includes the secret attribute. The reported default is $\mathbf{y} \in \{0,1\}^n$6-way queries, which were found to give the best trade-off (Annamalai et al., 2023).

For each query $\mathbf{y} \in \{0,1\}^n$7, let $\mathbf{y} \in \{0,1\}^n$8 and $\mathbf{y} \in \{0,1\}^n$9 denote the same query with the secret attribute removed. The conditional probability in $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$0 is

$$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$1

The adversary cannot observe this directly, but it can compute $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$2 because these are non-secret marginals, and it can compute the analogous conditional frequency from $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$3. It therefore forms

$$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$4

which serves as a noisy estimate of $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$5 (Annamalai et al., 2023).

The unknown secret vector is relaxed to a real-valued vector $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$6 with $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$7. Because the secret is binary and the attributes are discretized, each marginal $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$8 is a linear function of $$\mathcal{X} = \mathcal{X}_1 \times \dots \times \mathcal{X}_d$$9. This yields a linear system of the form

$d$0

where $d$1 is determined by $d$2 and the query definitions. The adversary solves the linear program

$d$3

It then rounds the target component: $d$4 Operationally, the attack consists of choosing 3-way conditional queries involving the secret attribute, computing $d$5 from $d$6 and $d$7, solving the linear program, and outputting the rounded target coordinate (Annamalai et al., 2023).

This construction differs from classic interactive database reconstruction in three respects. There is no interactive query interface, only a fixed synthetic release; the attacker cannot name arbitrary subsets of users by identifier; and marginals and conditionals over attribute combinations replace row-naming queries. The synthetic dataset functions as a noisy measurement mechanism.

4. Individual leakage, baselines, and empirical behavior

The target-randomization step is the conceptual center of the game. Because $d$8 is freshly randomized, any predictor based only on world knowledge, quasi-identifiers, or population-level correlations is correct in expectation with probability $d$9. This directly distinguishes individual-level inference from population-level inference. Yeom et al.’s attribute inference game was noted as allowing strong baselines such as majority-class prediction, and Stadler et al.’s synthetic-data attribute inference could predict sensitive attributes even for records not in the training set, which demonstrates the base-rate problem. In the reconstruction game, by contrast, a majority-class baseline cannot exceed the $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$0 rate, and an SDG such as IndHist, which breaks attribute associations, yields near-random attack accuracy as expected when there is no individual leakage (Annamalai et al., 2023).

The empirical study evaluates several SDG mechanisms: BayNet and its differentially private version PrivBayes; CTGAN; RAP and its DP version $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$1; and the baselines NonPrivate and IndHist. The datasets are ACS, using the 2018 Employment task for California with 16 attributes and secret attribute SEX, and FIRE, using 10 selected attributes with secret attribute ALS Unit. In each game instance, $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$2 records are sampled and 500 repetitions are run (Annamalai et al., 2023).

For a large synthetic data size $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$3, the linear reconstruction attack $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$4 attains high ROC AUC, greater than $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$5, and high accuracy for RAP, BayNet, and NonPrivate, while CTGAN and IndHist remain near random with AUC approximately $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$6. More specifically, RAP reaches up to $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$7 accuracy on ACS and up to $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$8 on FIRE at $\mathcal{S} \sim \mathrm{SDG}(\mathcal{D}, m),$9. Increasing $m$0 from $m$1 to $m$2 raises RAP’s attack accuracy by $m$3 percentage points on ACS and $m$4 percentage points on FIRE; BayNet exhibits similar growth, with increases of $m$5 and $m$6 percentage points, respectively (Annamalai et al., 2023).

The linear reconstruction attack is also compared with two earlier attacks: the distance-to-closest-record attack $m$7 of Chen et al. and the classifier-based inference attack $m$8 of Stadler et al. At $m$9, $n$00 outperforms or is statistically close to both on all SDGs. On RAP, the improvement over the best prior attack is $n$01 percentage points on ACS and $n$02 percentage points on FIRE. For CTGAN and IndHist, all attacks stay around $n$03 accuracy across all tested synthetic sizes (Annamalai et al., 2023).

A plausible implication is that outlier-focused attacks understate privacy risk for synthetic data. The reported reconstruction succeeds on arbitrary records rather than only specific outliers.

5. Utility metrics and the privacy-utility frontier

Utility is quantified using error on 3-way marginals, matching the statistics exploited by the attack. The first metric is Total Variation Distance on a fixed subset $n$04: $n$05 Averaging over random subsets $n$06 yields

$n$07

and the study uses $n$08, denoting this error by $n$09. The second metric is Mean Relative Error $n$10 on random 3-way marginals with original counts greater than $n$11. Lower $n$12 and $n$13 indicate better utility (Annamalai et al., 2023).

Privacy risk is defined as worst-case attack accuracy over the three attacks: $n$14 Trade-off curves then plot $n$15 against $n$16 and $n$17. The reported pattern is sharp. Whenever utility is good, for example $n$18 and $n$19, attack accuracy is never lower than about $n$20. On ACS, the best case in that regime is BayNet at $n$21 with $n$22, while RAP at $n$23 has $n$24. On FIRE, RAP at $n$25 has $n$26. Conversely, whenever $n$27, utility is poor. On ACS, for $n$28, the best $n$29 values are $n$30 for CTGAN at $n$31, $n$32 for BayNet at $n$33, and $n$34 for RAP at $n$35. On FIRE, the corresponding best $n$36 values are $n$37, $n$38, and $n$39 (Annamalai et al., 2023).

The paper therefore concludes that, in these experiments, no non-DP SDG simultaneously achieves $n$40 and $n$41. It also reports that increasing synthetic data size improves utility while making reconstruction more effective. For NonPrivate, RAP, and BayNet, as $n$42 increases, $n$43 and $n$44 shrink toward $n$45 and attack accuracy rises toward approximately $n$46 to $n$47. On FIRE with RAP, the attack accuracy is approximately $n$48 at $n$49, jumps by over $n$50 percentage points at $n$51, and reaches $n$52 at $n$53 (Annamalai et al., 2023).

The stated mechanism is statistical rather than algorithm-specific. More synthetic records make the empirical distribution of $n$54 approximate the learned model distribution more closely; if that model distribution is close to the empirical distribution of $n$55 on the chosen queries, then the estimates $n$56 become less noisy, the linear system is better conditioned, and reconstruction improves. This suggests that larger synthetic releases can strengthen both utility and individual reconstruction risk.

6. Differential privacy, mitigation, and alternative usage

The study evaluates two differentially private synthetic data generators: $n$57, which satisfies approximate differential privacy with $n$58-DP and $n$59, and PrivBayes, which is $n$60-DP. The motivating guarantee is standard: for neighboring datasets differing in one individual, changing that record should not substantially alter the distribution of outputs. Since the privacy game changes one target’s secret bit, differential privacy directly constrains how much the synthetic dataset can depend on that bit (Annamalai et al., 2023).

The empirical behavior is mixed but materially different from the non-DP case. For $n$61 on ACS at $n$62, relative to non-DP RAP and at $n$63, attack accuracy drops by $n$64 percentage points for $n$65, $n$66 percentage points for $n$67, and $n$68 percentage points for $n$69. Utility improves as $n$70 increases, and $n$71 generally has better utility than PrivBayes at the same $n$72. For large $n$73, the attack accuracy of $n$74 against $n$75 becomes almost independent of $n$76, which indicates that DP noise caps the benefit of additional synthetic records. PrivBayes shows similar monotone behavior in $n$77, but does not clearly dominate non-DP BayNet in the privacy-utility plane. On ACS, some $n$78 settings at $n$79 provide better combined privacy and utility than any non-DP method, although those guarantees are explicitly characterized as weak in a formal sense and heavily dependent on dataset and configuration (Annamalai et al., 2023).

The design principles that follow from this framework are correspondingly specific. Randomizing the target’s secret attribute removes base-rate confounding; requiring unique quasi-identifiers models re-identification; using per-record success probability and ROC analysis measures direct reconstruction performance; evaluating multiple attacks and taking $n$80 gives a worst-case empirical vulnerability measure; and utility metrics should align with the same class of statistics used by the attack. The source also notes possible extensions to one-hot encodings for non-binary attributes, more informative higher-order query selection, and richer threat models, but characterizes such directions as computationally demanding or as future work (Annamalai et al., 2023).

In a separate and terminologically distinct literature, e-Valuate provides a two-player attribute-value assignment game in which MAX proposes values and MIN assigns them to variables. For an arithmetic expression $n$81 over the digit domain $n$82, the game alternates between MAX choosing a digit and MIN choosing an uninstantiated variable to receive that digit, until the expression is fully instantiated. The outcome is compared with the minimax value $n$83, computed by backward induction on a finite sequential perfect-information zero-sum game tree, with alpha-beta pruning and transposition tables used to improve search efficiency (Aravamuthan et al., 2012). This is not a privacy game, but it shows that “attribute-value reconstruction game” also has a broader game-theoretic interpretation: one player chooses values, another controls their placement, and a scalar function evaluates the resulting full assignment.