Adaptive attribute inference attack: Exploiting privacy risks under adversarial perturbations
Author Identifier (ORCID)
Abstract
Machine learning models deployed in sensitive applications face two commonly studied but rarely unified risks: adversarial vulnerability and attribute privacy leakage. A widely held intuition suggests that adversarial perturbations and adversarial training, by degrading utility or distorting confidence scores, may incidentally suppress attribute inference attacks. In this paper, we show that this assumption is misleading. We introduce an Adaptive Attribute Inference Attack (AAIA) framework tailored to adversarial environments, which quantifies privacy risk under distribution shifts induced by adversarial perturbations. AAIA has two stages: Adaptive Shadow Model Attack (ASMA), which learns the adversarial output distribution to estimate the worst-case privacy risk ceiling via non-linear score mappings, and Adaptive Thresholding Attack (ATA), which diagnoses leakage severity by optimizing the inference threshold based on calibration data. Using AAIA, we uncover a counter-intuitive phenomenon termed Inverted Leakage, where adversarial perturbations induce a deterministic probability inversion and the prediction outputs systematically flip relative to the true attribute labels. Experimental results demonstrate that adversarial robustness changes the form of attribute leakage rather than eliminating it, underscoring the need for defenses that explicitly decouple sensitive attributes from robust representations.
Keywords
adversarial attack, attribute inference attack, privacy risk
Document Type
Conference Proceeding
Date of Publication
6-3-2026
Publication Title
ICT Systems Security and Privacy Protection
Publisher
Springer Nature
School
School of Science
RAS ID
95340
Funding Information
This paper is supported by the National Key Research and Development Program of China (2023YFB4302901), National Natural Science Foundation of China (No. 61802276), Tianjin Natural Science Foundation Project (24JCZDJC 01000), and the Fundamental Research Funds for the Central Universities of China (No.3122025091).
ISBN
978-3-032-27993-4
Copyright
subscription content
Recommended Citation
Liu, X., Lu, Y., Sun, A., Yang, W., Li, Y., & Johnstone, M. N. (2026). Adaptive attribute inference attack: Exploiting privacy risks under adversarial perturbations. In H. Janicke, L. Futcher, I. H. Sarker, K. L. Thomson, & P. Haskell-Dowland (Eds.), ICT systems security and privacy protection (IFIP Advances in Information and Communication Technology, Vol. 787). Springer.https://doi.org/10.1007/978-3-032-27993-4_36