Lower Bounds on the MMSE of Adversarially Inferring Sensitive Features

TL;DR

The paper develops a framework to adversarially evaluate the MMSE with which a sensitive feature $S$ can be inferred from noisy releases $X^{\sigma}$. It derives general lower bounds that separate empirical prediction error from finite-sample and approximation errors, offering training- and validation-based forms and refinements, including Bernstein-style concentration bounds. For linear-hypothesis classes, it provides closed-form, order-optimal bounds on the approximation error under various $(X,S)$ relationships, such as linear, BSC, and class-conditional Gaussian models, and extends to multi-modal Gaussian mixtures. Empirically, linear models often yield non-vacuous bounds with manageable data requirements, while neural networks can reduce the approximation error at the cost of potential overfitting; overall, the framework balances theoretical guarantees with practical computation to assess privacy risks in data obfuscation schemes. The results have implications for privacy-preserving data release and for evaluating adversarial inference in communication systems with finite-blocklength considerations.

Abstract

We propose an adversarial evaluation framework for sensitive feature inference based on minimum mean-squared error (MMSE) estimation with a finite sample size and linear predictive models. Our approach establishes theoretical lower bounds on the true MMSE of inferring sensitive features from noisy observations of other correlated features. These bounds are expressed in terms of the empirical MMSE under a restricted hypothesis class and a non-negative error term. The error term captures both the estimation error due to finite number of samples and the approximation error from using a restricted hypothesis class. For linear predictive models, we derive closed-form bounds, which are order optimal in terms of the noise variance, on the approximation error for several classes of relationships between the sensitive and non-sensitive features, including linear mappings, binary symmetric channels, and class-conditional multi-variate Gaussian distributions. We also present a new lower bound that relies on the MSE computed on a hold-out validation dataset of the MMSE estimator learned on finite-samples and a restricted hypothesis class. Through empirical evaluation, we demonstrate that our framework serves as an effective tool for MMSE-based adversarial evaluation of sensitive feature inference that balances theoretical guarantees with practical efficiency.

Figures (17)

• Figure 1: A company aims to release a sanitized version of user data by adding noise to the original features $X$, yielding $X^\sigma$, while protecting a sensitive attribute $S$. To evaluate the risk of adversarial inference, an internal red team is tasked with estimating how well $S$ can be predicted from $X^\sigma$ using provided samples of $(X^\sigma,S)$ pairs and a learning model, providing guarantees on the effectiveness of the noise mechanism.
• Figure 2: An illustration of how the class-conditional densities $f_i^\sigma$ of $X^\sigma\vert S=i$, for $i\in\{0,1\}$, and the optimal estimator $\theta^\sigma$ evolve in the binary symmetric channel setting of Theorem \ref{['thm:delta-a-bsc-example']}, as the noise level $\sigma$ increases. Here, $p=1/2$ and $p_N=1/4$. As $\sigma$ grows, the conditional densities progressively resemble pure Gaussians rather than Gaussian mixtures. This leads $\theta^\sigma$ to become increasingly linear and ultimately converge to a constant function.
• Figure 3: Comparison of the bounds $\epsilon_A^\text{BSC}$ (using the first four terms of the series in \ref{['eq:epsilon-a-bsc']}) and $\epsilon_A^\text{CCG}$ (from \ref{['eq:eps-ccg-d']}) against the true value of $\epsilon_A$ in the binary symmetric channel (BSC) and class-conditional Gaussian (CCG) settings, corresponding to \ref{['thm:delta-a-bsc-example']} and \ref{['cor:CCG-vector-diag-cov']}, respectively. Both bounds become tighter for large $\sigma$ but are loose for small $\sigma$. The true $\epsilon_A$ is computed using the closed-form expression for $\eta^\sigma$, with two independent sets of 1M samples of $(X^\sigma, S)$: one to estimate the statistics used in the closed-form expression of the optimal linear estimator $\theta^*_L$ defined in \ref{['eq:opt-theta-l-form']} in order to obtain $h^*_\mathcal{H}$, and another to estimate the expectation. In the BSC case, $\epsilon_A = 0$ when $\sigma = 0$, since $X$ is Bernoulli and $\eta^\sigma(x)$ therefore only needs to be learned at $x=0$ and $x=1$. A sigmoid-composed-with-linear model can exactly match these values, yielding zero approximation error. The parameters for the BSC setting are $p = 1/4$ and $p_N = 1/4$; for the CCG setting, they are $p = 1/4$, $\sigma_0^2 = 1$, $\sigma_1^2 = 3$, $\mu_0 = -1$, $\mu_1 = 1$, and $d = 1$.
• Figure 4: Bound on the MMSE as a function of the noise deviation $\sigma$. For the BSC, the parameters are: $p=1/4$ and $p_N=1/4$, while for the CCG, the parameters are $p=1/4, \sigma_0^2 = 1, \sigma_1^2 = 3, \mu_0 = -1, \mu_1 = 1$ and $d=1$. Here $\mathrm{MSE}_\text{train}(\hat{h}_\mathcal{H})$ is calculated with $n=500$ samples. Note that most of the gap between the true MMSE and the given bound comes from $\epsilon_C$ and a linear evaluation model is sufficient for bounding MMSE even for settings where a non-linear model would be optimal.
• Figure 5: Comparison of linear models and single hidden layer neural networks with $d_w=10$ on the class-conditional Gaussian dataset as a function of dimension $d$ for different number of finite samples $n$.

Theorems & Definitions (25)

• Theorem 1
• proof : Proof sketch
• Remark 1
• Proposition 1
• proof
• Remark 2
• Theorem 2
• proof : Proof sketch
• Remark 3
• Proposition 2