\section{Introduction}





Tabular data is one of the most popular data types in reality. It must be kept confidential when it includes valuable and sensitive information. To achieve this, many different approaches have been introduced to protect the privacy of tabular data~\cite{Jordon2019PATEGANGS, anonymization}. In recent years, tabular data synthesis using deep models has been actively investigated since it synthesizes fake records after learning from real records; synthesized tables show behavior similar to the original tables. Generative models guarantee enhanced privacy protection as they output fake records that do not directly correspond to any specific real record, unlike previous methods (e.g., k-anonymity~\cite{kanonymity} or differential privacy ~\cite{chen2018differentially}). However, recent research has revealed that generative models are susceptible to the membership inference attack (MIA), where attackers can infer if a given record was used to train a victim model~\cite{Dwork}. This can put its original training data at substantial risk of being leaked to the attackers.

Unfortunately, most of the research on MIA against generative models has focused on image data~\cite{hayes2018logan, hilprecht2019monte, Chen_2020}. In this paper, we empirically study MIA in the context of tabular data synthesis. Using the state-of-the-art MIA methods, in other words, we attack the state-of-the-art tabular data synthesis models, which have not been done previously. To our knowledge, we are the first to report the results. More specifically, we conduct experiments in which the tabular synthesis models trained on 4 tabular datasets are attacked under the following two scenarios: i) the black-box attack, where attackers have access only to fake records generated by the victim model, and ii) the white-box attack, where attackers know the internals of the victim model.

We evaluate and compare attack success scores under the two attack scenarios. Moreover, we analyze under what condition tabular data synthesis models become vulnerable to the attack. As a countermeasure to MIA, we conduct additional experiments where the victim models are trained with the two differentially private (DP) deep learning training algorithms -- DP-SGD~\cite{Abadi_2016} and DP-GAN~\cite{xu2018dpgan} -- and compare the results with the models trained without any DP algorithm. These analyses have not been studied yet under the context of tabular data synthesis. Our key findings are as follows:
\begin{compactenum}
    \item As the attacker collects more fake records, the attack is more successful, but there is a limit over which the success rate does not increase. 
    \item The earth mover's distance (EMD) between real and fake tabular data highly correlates to the attack success rate. It is an effective surrogate to predict whether fake tabular data is vulnerable to MIA or not (cf. Table~\ref{tab:correlation}).
    \item Tabular data synthesis models trained with DP-GAN show better generation quality than those with DP-SGD, which are even similar to the models without DP in some cases.
    \item DP-GAN sometimes preserves the models' generation quality yet is vulnerable to a white-box attack; on the other hand, DP-SGP is more robust to the white-box attack but sacrifices the models' generation quality.
    \item In general, we recommend \texttt{OCT-GAN} among the tested models since it is balanced between synthesis quality and privacy.
\end{compactenum}

We note that our main contribution in this paper is that we attack state-of-the-art tabular data synthesis methods with state-of-the-art MIA methods and derive several findings as listed above. We hope that our findings can help other followers who want to study the MIA in the tabular data synthesis context.


\section{Related Work \& Preliminaries}
We review various state-of-the-art tabular data synthesis models, MIA attack methods, and the differential privacy.

\subsection{Tabular Data Synthesis}
\emph{Tabular data synthesis models} generate realistic records by modelling a joint probability distribution of columns in a table. As standard generative models do, a \emph{generator} network takes as its input a noisy vector $\bm{z}$ and outputs a fake record. However, as tabular data is characterized by its high dimensionality with a mix of numeric and categorical data, tabular data synthesis models are more designed for handling various distributions and computational problems. For instance, \texttt{TVAE}~\cite{ishfaq2018tvae} is a variational autoencoder that effectively handles mixed types of features in tabular data. There are also many variants of GANs for tabular data synthesis.  \texttt{TableGAN}~\cite{DBLP:journals/corr/abs-1806-03384} generates tabular data using convolutional neural networks. \texttt{CTGAN}~\cite{NIPS2019_8953}, well-known for its tabular data synthesis quality, takes a conditional generator and incorporates its mode-specific normalization process. \texttt{OCT-GAN}~\cite{kim2021octgan} is a model based on neural ordinary differential equations both in generator and discriminator. 

\subsection{Membership Inference Attack}
The \emph{membership inference attack} (MIA) against generative models aims to determine whether a given record was used to train the victim model~\cite{Dwork}. It can threaten privacy as not only does it disclose raw personal data used in training but also allows potential information leakage of the model. Shokri et al.~\cite{shokri2017membership} presented the first MIA against classification models in the black-box setting and quantified the membership information leakage. This led to increasing research on MIA in machine learning models, especially on generative models. Hayes et al.~\cite{hayes2018logan} proposed the first MIA against generative models for images both in the black and white-box settings. Hilprechet et al.~\cite{hilprecht2019monte} proposed two MIAs, one is for GANs in the black-box setting, and the other is for VAEs in the white-box one. Chen et al.~\cite{Chen_2020} proposed a generic attack model which comprehends all scenarios from the black-box to the white-box setting, which we adopt for our experiments as follows: 
\begin{enumerate}
    \item As generative models are trained to estimate the training data distribution, attackers infer the membership $\bm{m}_i$ by using the probability of a given data $\bm{x}$ being generated by the victim model $\mathcal{G}_v$ as follows:
    \begin{align}
        P(\bm{m}_i=1|\bm{x}_i,\theta_v)\propto P_{\mathcal{G}_v}(\bm{x}|\theta_v).
    \end{align}
    However, as calculating the exact probability is intractable, they approximate it using the Parzen window density estimation~\cite{DudaHartStork01}:
    \begin{align} \label{eq:Parzen}
        P_{\mathcal{G}_v}(\bm{x}|\theta_v) \approx \frac{1}{k}\sum_{i=1}^k \exp(-\|\bm{x}- \mathcal{G}_v(\bm{z}_i)\|_2).
    \end{align}
    \item In the black-box scenario, attackers blindly collect $k$ fake records generated by the victim model and get a reconstructed copy of a data $\bm{x}$ as $\mathcal{R}(\bm{x}|\mathcal{G}_v)$ to approximate the probability in Eq.~\eqref{eq:Parzen} as follows:
    \begin{align}
        \mathcal{R}(\bm{x}|\mathcal{G}_v) = \underset{\hat{\bm{x}}\in\{\mathcal{G}_v(\cdot)_i\}_{i=1}^k}{\arg\min} \|\bm{x} - \hat{\bm{x}}\|_2, 
    \end{align}
    where $\{\mathcal{G}_v(\cdot)_i\}_{i=1}^k$ is a set of $k$ fake records collected by attackers.
    \item In the white-box scenario, attackers get $\mathcal{R}(\bm{x}|\mathcal{G}_v)$ to compute the probability in Eq.~\eqref{eq:Parzen} through optimizing $\bm{z}$ as follows:
    \begin{align}
        \mathcal{R}(\bm{x}|\mathcal{G}_v) = \mathcal{G}_v(\bm{z}^*),
    \end{align}
    where $\bm{z}^* = \underset{\bm{z}}{\arg\min} \text{ }\|\bm{x} - \mathcal{G}_v(\bm{z})\|_2.$
\end{enumerate}
However, all previous research has focused on generative models for image data, not for tabular data, albeit some used tabular data in their experiments by heuristically modifying the models for tabular data. However, as tabular data requires pre-processing of its complex data distribution, such heuristics can mislead the analysis. To this end, this paper aims to target tabular data synthesis models for an accurate analysis on MIA on tabular data.

\subsection{Differential Privacy}
\emph{Differential privacy} (DP) is a stochastic defense mechanism for training machine learning models to preserve the membership privacy of individual samples against MIA~\cite{dwork2014algorithmic}. As a model trained with DP does not remember any specific record, DP has known to protect well machine learning models against MIA~\cite{Chen_2020, beaulieu2019privacy}. DP-SGD~\cite{Abadi_2016}, which perturbs the gradients of the model during training by clipping and adding noise to them, is the most widely-accepted DP algorithm. Adjusting DP-SGD being specialized for GANs, DP-GAN~\cite{xu2018dpgan} is another DP algorithm that achieves DP by replacing the gradient clipping with the weight clipping. 

\section{Empirical Study Design}
In this section, we describe our empirical study design. We conduct our experiments with 4 tabular data synthesis models and 4 real-world tabular datasets. 

\begin{figure*}
    \centering
    \captionsetup[subfloat]{justification=centering}
    
    \subfloat[\texttt{Adult}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0},clip]{images/fig1-Adult.png}\label{fig4-a}} \hfill
    \subfloat[\texttt{Alphabank}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0.24cm},clip]{images/fig1-Alphabank.png}\label{fig1-b}} \hfill
    \subfloat[\texttt{Surgical}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0},clip]{images/fig1-Surgical.png}\label{fig4-c}} \hfill
    \subfloat[\texttt{King}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0.28cm},clip]{images/fig1-king.png}\label{fig1-a}} \\

    \subfloat[\texttt{Adult}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0},clip]{images/fig2-Adult.png} \label{fig5-a}}\hfill
    \subfloat[\texttt{Alphabank}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0.276cm},clip]{images/fig2-alphabank.png}\label{fig1-d}} \hfill
    \subfloat[\texttt{Surgical}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0},clip]{images/fig2-Surgical.png}   \label{fig5-c}} \hfill
    \subfloat[\texttt{King}]{\includegraphics[width=0.48\columnwidth,trim={0.7cm 0 0 0.26cm},clip]{images/fig2-King.png}\label{fig1-c}}\\
    
    \caption{(top) The AUROC scores of the black-box attack w.r.t. the number of fake records collected by attackers on \texttt{CTGAN}. The more samples attackers collect, the more successful the attack becomes. After attackers collect more than 100 samples, AUROC scores start to be satiated. (bottom) Comparison between AUROC scores of the black-box attack and the white-box attack for all victim models with 100 generated samples. Victim models are more vulnerable to the white-box attack.}
    \label{fig:fig1}
\end{figure*}


\subsection{Datasets}
We first introduce the following 4 real-world tabular datasets: i) \texttt{Adult} \cite{adult} consists of demographic information to predict whether each person's income exceeds \$50K per year based on census data, and the size of the dataset is 32K records. ii) \texttt{Alphabank} \cite{alphabank} contains 30K records. It is to predict the success of bank telemarketing based on personal financial information. iii) \texttt{King} \cite{king} is a regression dataset to predict house sale prices, which consists of 25K records. iv) \texttt{Surgical} \cite{surgical} is a binary classification dataset, which contains surgical patient information. The dataset contains 13K records.  

\subsection{Victim Generative Models}
As attackers are more likely to target well-trained generative models in practice ~\cite{Chen_2020}, we consider \texttt{CTGAN}, \texttt{TVAE}, \texttt{TableGAN} and \texttt{OCT-GAN} as our victim models, which all show high synthesis quality.

\subsection{Evaluation Method and Metrics}


\begin{table}
\small
    \centering
    \caption{Macro F1 scores ($R^2$ score for \texttt{King}) of victim models with 100 generation samples (1000 for \texttt{King}). All victim models shows reasonable generation quality.}

    \begin{tabular}{c|cccccccccc}
    \specialrule{1pt}{1pt}{1pt}
    \setlength{\tabcolsep}{1pt}
     Dataset  & \texttt{Identity} & \texttt{CTGAN} & \texttt{TVAE} & \texttt{TableGAN} & \texttt{OCT-GAN} & \\ \hline
     \texttt{Adult}   & 0.778 & 0.562 & 0.665 & 0.536 & 0.546 & \\
     \texttt{Alphabank}   & 0.510 & 0.501 & 0.490 & 0.488 & 0.500 & \\
     \texttt{Surgical}   & 0.752 & 0.678 & 0.597 & 0.578 & 0.659 &  \\ 
     \texttt{King}   & 0.421 & 0.250 & 0.444 & 0.357 & 0.293 & \\ \hline

    \end{tabular}
    \label{tab:my_label}
 \end{table}

To evaluate the generation quality, we i) train auxiliary machine learning algorithms, i.e., AdaBoost \cite{adaboost}, DecisionTree \cite{decisiontree}, and Multi-layer Perceptron \cite{mlp}, with synthesized records, and ii) test them on a binary classification or a regression task using test records, which we repeat 10 times with different seeds. We use the following three metrics: i) Macro F1 (resp., $R^2$) score on a binary classification (resp., a regression) task, ii) the average of the minimum column-wise Euclidean distance between real and fake records, and iii) the average of column-wise Earth Mover's Distance (EMD) for the dissimilarity between real and fake records distributions. We present the generation quality of victim models in Table~\ref{tab:my_label}. \texttt{Identity} is a baseline where we perform sampling with replacement from the training set, which means a model whose score is close to \texttt{Identity} has a good generation quality.

To evaluate attack success scores, we measure the area under the Receiver Operating Characteristic curve (AUROC), one of the most important metrics for binary classification. The most successful the membership inference attack, the close to 1 the AUROC score. If the inference is the same as a random classifier, AUROC is 0.5.


\section{Empirical Study Results}
We summarize our empirical study analysis results for the black-box and the white-box attacks. Source codes and data are available at \url{https://github.com/JayoungKim408/MIA}.
\begin{table*}
\small
\centering
\setlength{\tabcolsep}{3pt}
\caption{Pearson correlation coefficient between the AUROC score of the black-box attack and various generation quality metrics}
\label{tab:correlation}
\begin{tabular}{ccccccccccccccccccccccccc}
\specialrule{1pt}{1pt}{1pt}
 &  & \multicolumn{5}{c}{\texttt{Alphabank}} &  & \multicolumn{5}{c}{\texttt{Adult}} &  & \multicolumn{5}{c}{\texttt{Surgical}} &  & \multicolumn{5}{c}{\texttt{King}} \\ \cline{3-7} \cline{9-13} \cline{15-19} \cline{21-25} 
 &  & \multirow{2}{*}{Macro F1} &  & Euclidean &  & \multirow{2}{*}{EMD} &  & \multirow{2}{*}{Macro F1} &  & Euclidean &  & \multirow{2}{*}{EMD} &  & \multirow{2}{*}{Macro F1} &  & Euclidean &  & \multirow{2}{*}{EMD} &  & \multirow{2}{*}{R2} &  & Euclidean &  & \multirow{2}{*}{EMD} \\
 &  &  &  & distance &  &  &  &  &  & distance &  &  &  &  &  & distance &  &  &  &  &  & distance &  &  \\ \hline
\texttt{CTGAN} &  & 0.927 &  & -0.88 &  & -0.982 &  & 0.998 &  & 0.868 &  & -0.945 &  & 0.980 &  & 0.740 &  & -0.971 &  & 0.891 &  & -0.504 &  & -0.968 \\ 
\texttt{TVAE} &  & 0.849 &  & 0.093 &  & -0.99 &  & 0.883 &  & 0.084 &  & 0.694 &  & 0.995 &  & -0.972 &  & -0.922 &  & 0.869 &  & 0.552 &  & -0.941 \\ 
\texttt{TableGAN} &  & 0.649 &  & 0.888 &  & -0.975 &  & 0.891 &  & 0.959 &  & -0.974 &  & 0.942 &  & -0.924 &  & -0.998 &  & 0.943 &  & -0.810 &  & 0.339 \\ 
\texttt{OCT-GAN} &  & 0.990 &  & 0.873 &  & -0.868 &  & 0.998 &  & -0.933 &  & -0.987 &  & 0.989 &  & -0.990 &  & -0.993 &  & 0.977 &  & 0.339 &  & 0.316 \\ \hline
\end{tabular}
\end{table*}

\subsection{Black-box Attack}
We analyze experimental results on the black-box attack in twofold: i) how much the number of fake records collected by attackers influences the success of the attack and ii) how much the generation quality of victim models is correlated to the success of the attack. Fig.~\ref{fig:fig1} (top) shows the AUROC scores of the black-box attack with respect the number of fake records collected by attackers on \texttt{CTGAN}. There is a clear tendency for AUROC scores to increase with the larger number of collected fake records. As black-box attackers can only access fake records generated by victim models, a larger collection allows membership inference with more knowledge about the victims. Interestingly, the AUROC scores get flattened after more than 100 samples are collected, which means there exists a threshold that attackers may want to consider for practical attack efficiency. 
Table~\ref{tab:correlation} shows Pearson correlation coefficient between the generation quality and the AUROC score of the black-box attack. For Macro F1, larger values are preferred in terms of the generation quality, while for Euclidean distance and EMD, smaller ones are. Thus, a positive (resp., negative) correlation for Macro F1 (resp., for Euclidean distance and EMD) to AUROC indicates that victim models of better generation quality tend to be more vulnerable to the black-box attack. However, as shown in our experimental result, EMD shows a more reliable tendency than Euclidean distance. For example, Euclidean distance has all positive correlations except \texttt{CTGAN} for \texttt{Alphabank}, which happens by the corner case of the metric where most fake records are close to few real records. Notably, in our cases, EMD explains the correlation better than Euclidean distance, which is widely used to evaluate the generation quality in research on attacks~\cite{Chen_2020, hayes2018logan, ChoquetteChoo2020LabelOnlyMI}. 



\subsection{White-box Attack} \label{wb}
As mentioned earlier, the AUROC scores of the black-box attack are satiated with more than 100 fake records collected. For fairness, therefore, we conduct experiments on the white-box attack with 100 collected samples. Note that white-box attackers can generate fake records by themselves from victim models by feeding the noisy vector $\bm{z}$. We let victim models generate 100 fake records for each attack and evaluate AUROC on them. Fig.~\ref{fig:fig1} (bottom) shows a comparison between the AUROC scores of the black and white-box attack on all victim models. In all cases, the white-box attack has higher AUROC scores than the black-box attack, which is intuitive as white-box attackers have full control over victim models. 





\subsection{Defense with Differential Privacy}
We conduct additional experiments on two DP algorithms, DP-SGD and DP-GAN. Due to the scarcity of study about training specific neural network designs with DP algorithms, e.g., moving of \texttt{TableGAN} is not studied, we target only on \texttt{CTGAN}, which consists of trainable network designs by DP algorithms that are currently available. However, as computing the gradient penalty of the WGAN-GP loss~\cite{wgangp} of \texttt{CTGAN} is challenging with DP algorithms, we change it to the Wasserstein loss~\cite{wgan}. Accordingly, we retrain and evaluate the modified \texttt{CTGAN} without DP algorithms as well for an accurate comparison. We repeat each experiment more than 100 times to average out the effect of the randomness in the DP algorithms. 

Fig.~\ref{fig:fig3} summarizes the comparisons of Macro F1, Euclidean distance, and AUROC of the black and white-box attack on \texttt{CTGAN} for \texttt{Adult} with respect to $\sigma = \{1e-05, 1e-04, 0.5\}$. $\sigma$ controls how much noise to be added to the gradients; thus, there is a trade-off between privacy and model accuracy. In Fig.~\ref{fig:fig3} (a) and (b), compared to training without DP algorithms, training with DP algorithms deteriorates the generation quality. However, DP-GAN shows the generation quality which is better than DP-SGD or even similar to models without DP at lower $\sigma$. Also, DP-GAN worsens the generation quality as $\sigma$ increases, while there is no such pattern for DP-SGD. This is because DP-GAN is specially designed for training GANs with theoretical correctness~\cite{dpgan}. 

In Fig.~\ref{fig:fig3} (c) and (d), models trained with DP algorithms show lower AUROC scores both on the black and white-box attack than models without DP algorithms, as expected. In Fig.~\ref{fig:fig3} (c), DP-GAN shows better robustness to the black-box attack, albeit both show AUROC scores less than 0.5, which means incorrect inference towards membership. Interestingly, the white-box attackers can still infer membership correctly; in Fig.~\ref{fig:fig3} (d), DP-SGD shows better robustness to the white-box attack than DP-GAN; as the white-box attackers can access victim models, DP-GAN, which less deteriorates victims, shows higher vulnerability to attacks. 



\begin{figure*}
    \centering
    \captionsetup[subfloat]{justification=centering}
    \subfloat[Macro F1 \\ (trained without DP = 0.60)]{\includegraphics[width=0.48\columnwidth,trim={0.75cm 0 0 0.28cm},clip]{images/fig3_1-adult.png}}\hfill
    \subfloat[Euclidean Distance \\(trained without DP = 0.33)]{\includegraphics[width=0.48\columnwidth,trim={0.75cm 0 0 0.25cm},clip]{images/fig3_2-adult.png}} \hfill 
    \subfloat[AUROC of the black-box attack \\ (trained without DP = 0.77)]{ \includegraphics[width=0.48\columnwidth,trim={0.75cm 0 0 0.25cm},clip]{images/fig3_3-adult.png}}\hfill
    \subfloat[AUROC of the white-box attack \\ (trained without DP = 0.79)]{\includegraphics[width=0.48\columnwidth,trim={0.75cm 0 0 0.25cm},clip]{images/fig3_4-adult.png}}
            
    \caption{Macro F1, Euclidean distance, and the AUROC scores of the black-box and the white-box attacks on \texttt{CTGAN} for $\texttt{Adult}$ trained with DP-SGD and DP-GAN w.r.t. {$\sigma=\{1e-05, 1e-04, 0.5\}$}, tested on 100 fake record generations. Values in the parentheses under $\sigma$ on X-axis mean $\epsilon$. Values in parentheses contain the results of \texttt{CTGAN} without DP. For DP-GAN, we clip weights to be 1.0. Other datasets show the same pattern, which we refer to Figs.~\ref{fig:fig6}, \ref{fig:fig7} and \ref{fig:fig8}.}
    \label{fig:fig3}
\end{figure*}

\section{Conclusions}
In this paper, we investigated under which conditions tabular data synthesis models are vulnerable to two MIA paradigms, the black-box and the white-box attack, and how defense algorithms can protect them. We conducted experiments with 4 tabular data synthesis models and 4 real-world tabular datasets. 

As expected, the experimental results show that i) as attackers are more knowledgeable about victim models, i.e., when they collect more fake records in the black-box attack or can access the models in the white-box attack, and ii) as models synthesize better representative samples, models are more vulnerable. iii) When models are trained with DP algorithms, models are more robust on the attacks. We also reported detailed findings in Sec. 1.

As shown in experimental results of the defense with two DP algorithms, both have pros and cons; DP-SGD largely ruins the generation quality of victim models while protecting them against the white-box attack; DP-GAN preserves the generation quality of victim models while exposing them more to the white-box attack. This implies that one may decide how to defend tabular data synthesis models based on his/her purpose. For instance, one may sacrifice high-quality generation for enhanced privacy guarantee by adopting DP-SGD. This also motivates future work of combining two different approaches from DP-SGD and DP-GAN.

Our paper delivered several empirical messages and findings that are hard to know without conducting all those experiments. We think our paper can enlighten and guide others worried about privacy concerns regarding their fake tabular data.




\begin{acks}
Noseong Park is the corresponding author. This work was supported by the Institute of Information \& Communications Technology Planning \& Evaluation (IITP) grant funded by the Korean government (MSIT) (10\% from No. 2020-0-01361, Artificial Intelligence Graduate School Program at (Yonsei University and 90\% from No. 2021-0-00231, Development of Approximate DBMS Query Technology to Facilitate Fast Query Processing for Exploratory Data Analysis)). The work by Sushil Jajodia was supported by the U.S. Office of Naval Research grants N00014-20-1-2407 and N00014-18-1-2670, and by the U.S. National Science Foundation grant CNS-1822094.
\end{acks}


\clearpage
\bibliographystyle{ACM-Reference-Format}
