Technical Summary: FERMI – Exploiting Relations for Membership Inference Against Tabular Diffusion Models

1. Problem Statement

Diffusion models have become the leading paradigm for synthesizing tabular data, particularly in high-stakes domains like healthcare and finance where privacy regulations (e.g., GDPR, HIPAA) restrict direct data release. While Membership Inference Attacks (MIAs) are the standard tool for assessing the privacy risks of such generative models, existing attacks predominantly assume a single-table setting.

This assumption overlooks the reality that sensitive tabular data typically resides in multi-relational databases, where an individual's information spans interconnected tables (e.g., patients linked to prescriptions, lab results, and demographics). Current evaluations that ignore this relational structure risk significantly underestimating privacy exposure.

A critical challenge arises in realistic threat models: an adversary may possess rich auxiliary data containing full relational structures (e.g., through prior breaches or public releases) during the attack training phase. However, at membership inference time, the adversary often observes only a candidate row from the target table, lacking access to that specific individual's records in related parent or child tables. The paper addresses the gap of how to leverage relational auxiliary information available during training to mount a stronger attack, even when the inference is restricted to single-table attributes.

2. Methodology: FERMI Framework

The authors propose FERMI (FEature-mapping for Relational Membership Inference), a framework designed to distill relational membership signals into a single-table feature space. The approach follows the standard shadow-model paradigm and operates in three stages:

A. Paired Feature Extraction

The adversary trains $S$ shadow diffusion models on disjoint subsets of an auxiliary dataset ($D_{aux}$). For each shadow record, two feature streams are extracted:

1. Single-table Stream: Features $\Phi_{single}(x)$ are extracted from a shadow model trained solely on the target table $T_j$.
2. Relational Stream: Features $\Phi_{multi}(\tilde{x})$ are extracted from a shadow model trained on a merged representation where the target record $x$ is augmented with its relational context (e.g., joined with parent tables $T_p$).

The feature extraction utilizes a loss-fingerprint approach, computing the denoising loss $\ell_{\theta}(x_0, t, \epsilon)$ over multiple timesteps and noise realizations. Empirically, training members exhibit systematically lower denoising losses than non-members.

B. Feature Mapping

The core innovation is learning a mapping function $f_{map}$ that projects single-table features toward their relational counterparts. This is formulated as a domain adaptation problem with two objectives:

1. Point-wise Reconstruction: Minimizing the Euclidean distance between the mapped features and the true relational features: $\|f_{map}(\Phi_{single}(x)) - \Phi_{multi}(\tilde{x})\|^2_2$.
2. Distributional Alignment: Using the CORAL (Correlation Alignment) loss to match the covariance structures of the mapped and true multi-table feature spaces, ensuring the relational geometry is preserved.

C. Membership Prediction

An attack classifier $f_{att}$ is trained on the mapped features to predict membership labels. The framework allows for joint fine-tuning of both the mapper and the classifier, where gradients from the classification objective refine the mapper to extract features most informative for membership inference.

Threat Model:

• Training Phase: The adversary has access to auxiliary data with full relational structure (Parent-Context Side Information or Full-Relational Side Information).
• Inference Phase: The adversary is restricted to the target table only (single-row access) and the target model (or its synthetic outputs in black-box settings). The mapper is applied to the single-table features to recover the relational signal without needing the related tables at inference time.

3. Key Contributions

1. Formalization of Relational MIAs: The paper demonstrates that relational context yields substantially stronger membership signals in tabular diffusion models compared to single-table settings and formalizes the membership inference problem in multi-relational settings.
2. FERMI Framework: It introduces a feature-mapping framework that successfully distills relational membership signals into the single-table feature space. This enables stronger attacks without requiring access to relational data at inference time, resolving the training-inference asymmetry.
3. Comprehensive Evaluation: The framework is evaluated across three diffusion architectures (TabDDPM, TabSyn, TabDiff) and three real-world relational datasets (California, Instacart, Berka) under both white-box and black-box settings.

4. Experimental Results

The evaluation covers three datasets and three model architectures, comparing three settings: Direct Single-Table (baseline), Direct Merged-Table (upper bound with full relational access), and FERMI.

• Performance Gains: FERMI consistently outperforms single-table baselines.
  • In the white-box setting, FERMI improved the True Positive Rate at 0.1 False Positive Rate (TPR@0.1FPR) by up to 53% over the single-table baseline for TabDDPM and TabDiff.
  • In the black-box setting (using surrogate models trained on synthetic data), FERMI improved TPR@0.1FPR by 22% over the baseline.
• Model Sensitivity:
  • TabDDPM and TabDiff (data-space models) showed high susceptibility to relational attacks. The "Merged" attack (full relational access) achieved near-ceiling performance (e.g., TPR@0.01 of 0.994 on Instacart for TabDDPM), highlighting severe privacy risks when relational data is involved.
  • TabSyn (latent-space model) proved remarkably resistant. Even with full relational access, its AUC remained near random guessing levels. This suggests the latent-space bottleneck acts as a structural privacy protection, and FERMI could not distill useful signals because the relational signal itself was weak for this architecture.
• Black-Box Extension: The paper confirms that the relational signal persists even when the adversary only observes synthetic data. FERMI recovered approximately 55% of the AUC gap between the single-table baseline and the merged-table upper bound in the black-box setting.

5. Significance and Claims

The paper claims that evaluating tabular diffusion models in single-table settings meaningfully underestimates true privacy risk. The presence of relational structure in training data creates stronger membership traces that can be exploited by adversaries with auxiliary relational knowledge.

Key findings include:

• Relational Context as a Vulnerability: The relational structure encodes richer conditioning signals that diffusion models internalize, leaving stronger fingerprints in the denoising loss.
• Architectural Dependence: Privacy risks are highly dependent on the model architecture. Models operating directly on data space (TabDDPM, TabDiff) are significantly more vulnerable than those using latent encoding (TabSyn).
• Practical Implications: The FERMI framework demonstrates that an adversary does not need direct access to related tables at inference time to mount a sophisticated attack; they only need to have learned the relational mapping during the training phase.

The authors conclude that architectural decisions made upstream of privacy mechanisms (e.g., choosing latent-space vs. data-space diffusion) deserve closer scrutiny in privacy-sensitive deployments, as the latent encoding appears to be the primary determinant of membership inference resistance in relational settings.