A reconstruction attack on a private dataset $D$ takes as input some publicly accessible information about the dataset and produces a list of candidate elements of $D$. We introduce a new class of data reconstruction attacks based on randomized methods for non-convex optimization. We empirically demonstrate that our attacks can not only reconstruct full rows of $D$ from aggregate query statistics $Q(D)\in \mathbb{R}^m$, but can do so in a way that reliably ranks reconstructed rows by their odds of appearing in the private data, providing a signature that could be used for prioritizing reconstructed rows for further actions such as identify theft or hate crime. We also design a sequence of baselines for evaluating reconstruction attacks. Our attacks significantly outperform those that are based only on access to a public distribution or population from which the private dataset $D$ was sampled, demonstrating that they are exploiting information in the aggregate statistics $Q(D)$, and not simply the overall structure of the distribution. In other words, the queries $Q(D)$ are permitting reconstruction of elements of this dataset, not the distribution from which $D$ was drawn. These findings are established both on 2010 U.S. decennial Census data and queries and Census-derived American Community Survey datasets. Taken together, our methods and experiments illustrate the risks in releasing numerically precise aggregate statistics of a large dataset, and provide further motivation for the careful application of provably private techniques such as differential privacy.

翻译：针对私有数据集$D$的重构攻击，通过利用数据集的公开可访问信息生成候选元素列表。我们提出一类基于非凸优化随机方法的新型数据重构攻击。实验证明，该方法不仅能从聚合查询统计量$Q(D)\in \mathbb{R}^m$中重构$D$的完整数据行，还能以置信度排序方式可靠标记各行在原始数据中出现的概率，为优先处理重构行（如身份盗窃或仇恨犯罪）提供特征标识。我们同时设计了评估重构攻击的基线方法序列。相较仅基于私有数据采样来源的公开分布或总体访问方法，我们的攻击显著更优，表明攻击有效利用了聚合统计量$Q(D)$中的信息而非分布的整体结构特征。换言之，查询集$Q(D)$允许重构数据集元素，而非生成$D$的源分布。这些结论在2010年美国十年一次普查数据及查询、以及基于普查的美国社区调查数据集中得到验证。综合而言，我们的方法与实验揭示了发布大规模数据集精确聚合统计量的风险，并进一步论证了谨慎应用差分隐私等可证明隐私保护技术的必要性。