Diffusion models are the leading approach for tabular data synthesis and are increasingly used to share sensitive records. Whether they actually protect privacy has become a pressing question. Membership inference attacks are the standard tool for this purpose, yet existing attacks assume a single-table setting and ignore the multi-relational structure of real sensitive data. A core challenge in assessing privacy risks from membership inference attacks in multi-table settings is how to leverage auxiliary information from relations associated with the target table, such as its parent tables. Particularly, we study a practical setting in which such auxiliary information is available only when training the attack model. At inference time, the attacker observes only the attribute values of the target record from the target table. We propose FERMI (FEature-mapping for Relational Membership Inference), which resolves this gap by enriching single-table features with relational membership signal. Across three tabular diffusion architectures and three real-world relational datasets, FERMI consistently improves attack performance over single-table baselines, with TPR@$0.1$FPR rising by up to 53% over the single-table baseline in the white-box setting and 22% in the black-box setting.

翻译：扩散模型是表格数据合成的主流方法，并日益被用于共享敏感记录。它们是否真正保护隐私已成为一个紧迫问题。成员推理攻击是评估隐私风险的标准工具，然而现有攻击假设单表场景，忽略了真实敏感数据的多关系结构。在多表设置中利用成员推理攻击评估隐私风险的核心挑战在于，如何利用与目标表相关联的辅助信息（例如其父表）。特别地，我们研究了一种实际场景：此类辅助信息仅在训练攻击模型时可用，而在推理阶段，攻击者仅能观察到目标记录在目标表中的属性值。我们提出FERMI（面向关系成员推理的特征映射），该方法通过用关系成员信号增强单表特征，从而解决这一差距。在三种表格扩散架构和三个真实关系数据集上，FERMI在攻击性能上始终优于单表基线。在白盒设置中，[email protected]相比单表基线提升高达53%，在黑盒设置中提升达22%。