{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/formalizing-and-estimating-distribution","title":"Formalizing and Estimating Distribution Inference Risks","arxiv_id":"2109.06024","date":"2021-09-13","proceeding":null,"authors":["Anshuman Suri","David Evans"],"abstract":"Distribution inference, sometimes called property inference, infers statistical properties about a training set from access to a model trained on that data. Distribution inference attacks can pose serious risks when models are trained on private data, but are difficult to distinguish from the intrinsic purpose of statistical machine learning -- namely, to produce models that capture statistical properties about a distribution. Motivated by Yeom et al.'s membership inference framework, we propose a formal definition of distribution inference attacks that is general enough to describe a broad class of attacks distinguishing between possible training distributions. We show how our definition captures previous ratio-based property inference attacks as well as new kinds of attack including revealing the average node degree or clustering coefficient of a training graph. To understand distribution inference risks, we introduce a metric that quantifies observed leakage by relating it to the leakage that would occur if samples from the training distribution were provided directly to the adversary. We report on a series of experiments across a range of different distributions using both novel black-box attacks and improved versions of the state-of-the-art white-box attacks. Our results show that inexpensive attacks are often as effective as expensive meta-classifier attacks, and that there are surprising asymmetries in the effectiveness of attacks. Code is available at https://github.com/iamgroot42/FormEstDistRisks","url_abs":"https://arxiv.org/abs/2109.06024v6","url_pdf":"https://arxiv.org/pdf/2109.06024v6.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"formalizing-and-estimating-distribution","repo_url":"https://github.com/iamgroot42/form_est_dist_risks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"BSD-2-Clause"}},{"paper_slug":"formalizing-and-estimating-distribution","repo_url":"https://github.com/iamgroot42/formestdistrisks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"inference-attack","task_name":"Inference Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2109.06024","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2109.06024"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/iamgroot42/form_est_dist_risks","reach":{"status":"ok","spdx":"BSD-2-Clause"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/iamgroot42/formestdistrisks","reach":null}],"summary":{"ran_draft_wrong":3,"unverified":11},"by_repo_kind":{"official":{"samples":14,"ran":3,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6eff479cbea3e29a","entry":"find_to_prune_for_mean_degree","repo":"iamgroot42/formestdistrisks","repo_kind":"official","path":"arxiv/data_utils.py","file_url":"https://github.com/iamgroot42/formestdistrisks/blob/HEAD/arxiv/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"6eff479cbea3e29a"}},{"code_sha256_prefix":"f40e50279ebbef17","entry":"find_to_prune_for_threshold_degree","repo":"iamgroot42/formestdistrisks","repo_kind":"official","path":"arxiv/data_utils.py","file_url":"https://github.com/iamgroot42/formestdistrisks/blob/HEAD/arxiv/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"f40e50279ebbef17"}},{"code_sha256_prefix":"aff1bea8d51561a3","entry":"neighbor_removal","repo":"iamgroot42/formestdistrisks","repo_kind":"official","path":"arxiv/data_utils.py","file_url":"https://github.com/iamgroot42/formestdistrisks/blob/HEAD/arxiv/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"aff1bea8d51561a3"}},{"code_sha256_prefix":"02d577039741f33c","entry":"chord","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/data_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"02d577039741f33c"}},{"code_sha256_prefix":"af78cce3251607a4","entry":"epoch","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/model_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"af78cce3251607a4"}},{"code_sha256_prefix":"1aae7e9452a19897","entry":"get_metrics","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/model_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"1aae7e9452a19897"}},{"code_sha256_prefix":"a185c02cd89bef2e","entry":"get_model_folder_path","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"boneage/model_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/boneage/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"a185c02cd89bef2e"}},{"code_sha256_prefix":"744d18d79255848c","entry":"load_all_loader_data","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"744d18d79255848c"}},{"code_sha256_prefix":"ca00012e2a738b06","entry":"log_string","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"ca00012e2a738b06"}},{"code_sha256_prefix":"0e10610f727fef31","entry":"overlay_botnet_on_graph","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/data_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"0e10610f727fef31"}},{"code_sha256_prefix":"0d35d1ccf120ef81","entry":"scaled_values","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"0d35d1ccf120ef81"}},{"code_sha256_prefix":"402b17de9d91f42e","entry":"test","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"arxiv/model_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/arxiv/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"402b17de9d91f42e"}},{"code_sha256_prefix":"5e91ee8bb1615456","entry":"train","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"arxiv/model_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/arxiv/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"5e91ee8bb1615456"}},{"code_sha256_prefix":"439ee18af6ad4263","entry":"true_positive","repo":"iamgroot42/form_est_dist_risks","repo_kind":"official","path":"botnets/model_utils.py","file_url":"https://github.com/iamgroot42/form_est_dist_risks/blob/HEAD/botnets/model_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"439ee18af6ad4263"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}