A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data

Let $\mathcal{S}=\{s_{1},...,s_{|\mathcal{S}|}\}$ represent the set of all regions of interest (ROIs) where location data is collected. Similarly, $\mathcal{T}=\{t_{1},...,t_{|\mathcal{T}|}\}$ denotes the set of time intervals, also known as epochs, during which data collection occurs. In this paper, we assume that the geographic positions (i.e. approximate longitude and latitude) of the ROIs are known. For example, $\mathcal{S}$ may represent a set of square regions that partition a city into a grid, and $\mathcal{T}$ may represent contiguous hours over one month.

We focus on the scenario where location data of a set of users $\Omega$ is collected over the ROIs $\mathcal{S}$ and the epochs $\mathcal{T}$. We define the location trace $L^{u}$ of a user $u\in\Omega$ as the set of geo-tagged and time-stamped visits $(s,t)$ that $u$ made within $\mathcal{S}$ during $\mathcal{T}$. We formally represent a user’s location trace as the binary matrix

Let $\mathcal{U}\subset\Omega$ be a group of $m$ users whose location data is aggregated. We define an aggregate $A^{\mathcal{U}}$ to be the aggregate count statistics for $\mathcal{U}$ over $\mathcal{S}\times\mathcal{T}$. Formally, this is defined by the sum

The entry $A^{\mathcal{U}}_{s,t}$ therefore corresponds to the number of users in $\mathcal{U}$ who visited ROI $s$ during epoch $t$.

The data collector may be wary of the privacy risks of releasing the raw aggregate $A^{\mathcal{U}}$, and therefore apply privacy measures before releasing it.

We assume that the data collector releases aggregate count statistics $\overline{A}^{\mathcal{U}}$ over the ROIs $\mathcal{S}$ and the epochs $\mathcal{T}$, for the $m$ users in the group $\mathcal{U}$ . There are various cases depending on the privacy measures applied prior to release:

The goal of an adversary $Adv$ performing an MIA on $\overline{A}^{\mathcal{U}}$ is to determine whether their target $u^{*}$ contributed to $\overline{A}^{\mathcal{U}}$, inferring IN for $u^{*}\in\mathcal{U}$ and OUT for $u^{*}\not\in\mathcal{U}$.

Given an aggregate release $\overline{A}^{\mathcal{U}}$ over $m$ users, an adversary infers membership of the target $u^{*}$ within the aggregation group $\mathcal{U}$ by using a binary membership classifier. Classifiers are commonly instantiated as machine learning models (Pyrgelis et al.,, 2017, 2020; Zhang et al.,, 2020), but statistical models, like the log-likelihood function, have been applied as well (Homer et al.,, 2008; Bauer and Bindschaedler,, 2020). To train the classifier, $Adv$ typically creates a balanced set of labeled size $m$ training aggregates (Pyrgelis et al.,, 2017; Zhang et al.,, 2020; Pyrgelis et al.,, 2020; Oehmichen et al.,, 2019). Half of the aggregates include the target trace $L^{u^{*}}$ and are labeled $IN$, and the other half are labeled $OUT$. Training the classifier will create a decision boundary in the underlying space of aggregate releases (Bishop and Nasrabadi,, 2006). In the case of aggregate location data over ROIs $\mathcal{S}$ and epochs $\mathcal{T}$, the decision boundary is characterized by a hypersurface that partitions the matrix space $\mathbb{R}^{|\mathcal{S}|\times|\mathcal{T}|}$ into two sets.

In this section, we present our Zero Auxiliary Knowledge (ZK) MIA threat model. It is commonly assumed in MIAs across various domains that the adversary has access to an auxiliary dataset and complete knowledge of the target record (Pyrgelis et al.,, 2017; Nasr et al.,, 2019; Salem et al.,, 2018; Truex et al.,, 2019; Yeom et al.,, 2018; Shokri et al.,, 2017). Our ZK threat model relaxes both assumptions by eliminating the need for an auxiliary dataset and allowing for only partial knowledge of the target trace.

For context, we also describe threat models of previous MIAs on aggregate location data. All threat models consider an adversary $Adv$, whose goal is to determine whether a specific target user $u^{*}$ is included in the released aggregate $\overline{A}^{\mathcal{U}}$. The aggregate is computed across $m$ users over ROIs $\mathcal{S}$ and epochs $\mathcal{T}$. We assume that the locations of the ROIs $\mathcal{S}$ are known.

Knock-Knock (Pyrgelis et al.,, 2017): The adversary has an auxiliary dataset $Ref=\{L(u_{1}),...,L(u_{|Ref|})\}$ of user traces, over the same locations and a similar population as the released aggregate. $Ref$ has at least $m$ traces, including the full target trace $L^{u^{*}}$.

LocMIA (Zhang et al.,, 2020): The adversary knows $u^{*}$’s social network and has an auxiliary dataset $Ref=\{L(u_{1}),...,L(u_{|Ref|})\}$ of user traces, over the same locations and a similar population as the released aggregate $\overline{A}^{\mathcal{U}}$. $Ref$ has at least $m$ traces, including the traces of $u^{*}$’s friends, but not $L^{u^{*}}$.

Zero Auxiliary Knowledge (ours): The adversary knows a subset of the target $u^{*}$’s visits. Equivalently, the adversary knows a partial target trace $\tilde{L}^{u^{*}}$, such that $supp(\tilde{L}^{u^{*}})\subset supp(L^{u^{*}})$.

KK MIA and LocMIA are reliant on the adversary’s access to an extensive auxiliary dataset $Ref$. In particular, $Adv$ samples individual traces from $Ref$ to create training aggregates. These traces are also assumed to range over the same locations, and belong to a similar population as the traces aggregated in the release $\overline{A}^{\mathcal{U}}$, in order to properly train the membership classifier (Section 2.4). However, individual traces are known to be sensitive (de Montjoye et al.,, 2013), and are unlikely to be made available, particularly when the data is aggregated as a privacy measure. Furthermore, because $Ref$ must contain at least $m$ traces, this assumption is impractical for even moderately sized aggregates. Although LocMIA removes prior knowledge about the target trace $L^{u^{*}}$, it must assume knowledge of $u^{*}$’s friends’ traces to create a suitable proxy. More importantly, LocMIA still requires a large auxiliary dataset of individual traces.

In contrast, our Zero Auxiliary Knowledge adversary only requires that the adversary has knowledge about the target’s location history. We emphasize that the adversary does not need to know the full trace $L^{u^{*}}$. Our threat model encompasses the case where only a few of the target’s visits are known to the adversary. For example, the adversary may infer some of $u^{*}$’s visits from social media activity or direct observation.

We implement the Zero Auxiliary Knowledge MIA as a binary classifier. However, whereas $Adv$ uses their auxiliary dataset as a reference for creating training aggregates for KK MIA and LocMIA, $Adv$ instead uses the reference of synthetic traces that they created from the released aggregate. Furthermore, if the full target trace $L^{u^{*}}$ is not known, $Adv$ may instead use a partial trace when creating the $IN$ training aggregates. Figure 3 illustrates ZK MIA’s overall attack architecture.

In order to generate synthetic traces for our Zero Auxiliary Knowledge MIA, we adapt a probabilistic mobility model (Farzanehfar et al.,, 2021). Farzanehfar et al., (2021) developed this model to reproduce unicity patterns in large populations. The model requires four statistical parameters, described below and illustrated in Figure 16 of the Appendix. Recall that for a discrete random variable $X$ taking values in $x_{1},...,x_{N}$, its probability mass function (p.m.f.) $\mathcal{P}:\{x_{1},...,x_{N}\}\to[0,1]$ maps each possible value to its corresponding probability.

1. (1)

   The marginal space distribution $\mathcal{P}_{S}:\mathcal{S}\to[0,1]$ is a p.m.f. such that $\mathcal{P}_{S}(s)$ is proportional to the number of visits to ROI $s$ by users in $\Omega$ across all epochs in $\mathcal{T}$.

2. (2)

   The marginal time distribution $\mathcal{P}_{T}:\mathcal{T}\to[0,1]$ is a p.m.f. such that $\mathcal{P}_{T}(t)$ is proportional to the number of visits during epoch $t$ by users in $\Omega$ across all ROIs in $\mathcal{S}$.

3. (3)

   The marginal activity distribution $\mathcal{P}_{A}$ models the total number of visits recorded within $\mathcal{S}$ during $\mathcal{T}$ by a user drawn from $\Omega$.

4. (4)

   The Delaunay triangulation, denoted $DT(\mathcal{S})$, is a triangulation with vertices corresponding to the set of positions (longitude and latitude) of ROIs in $\mathcal{S}$. $DT(\mathcal{S})$ has the property that no vertex lies inside the circumcircle of any triangle in $DT(\mathcal{S})$ (Delaunay et al.,, 1934).

We note that the Delaunay triangulation $DT(\mathcal{S})$ is determined by the locations of the ROIs. Since the locations of the ROIs are assumed to be known (Section 2.5), $DT(\mathcal{S})$ can be immediately obtained from the release. We explain how the other statistical inputs, the three marginal distributions, can be approximated from the released aggregate in Section 4.3.

We now describe our procedure, adapted from  Farzanehfar et al., (2021), for generating synthetic traces using the four inputs. For each synthetic trace $L^{syn}$, we first sample the number of visits $n_{visits}$ from the activity marginal $\mathcal{P}_{A}$. This determines the number of nonzero entries in the $\mathcal{S}\times\mathcal{T}$ matrix $L^{syn}_{s,t}$. Second, we sample an origin ROI $s_{0}$ from the space marginal $\mathcal{P}_{S}$, and a connected sub-graph $C(s_{0})$ from the Delaunay triangulation $DT(\mathcal{S})$, such that $s_{0}\in C(s_{0})$. $C(s_{0})$ will correspond to the set of ROIs that may be visited in $L^{syn}$. This is done to emulate the natural tendency to move to and from the same proximate locations (e.g. home and work). Finally, we sample $n_{visits}$ spatiotemporal visits $(s,t)$ for which we set $L^{syn}_{s,t}=1$. For each visit, $s$ is sampled from the space marginal $\mathcal{P}_{S}$ restricted to $C(s_{0})$, and $t$ is sampled from the time marginal $\mathcal{P}_{T}$. All the sampling steps are independent.

We make two modifications of the original algorithm (Farzanehfar et al.,, 2021). First, to avoid over-saturating unpopular regions, we sample the origin ROI $s_{0}$ according to the space marginal $\mathcal{P}_{S}$ rather than uniformly. Second, to allow users to visit multiple ROIs within the same epoch, we sample the epochs with replacement rather than without replacement. Our procedure is summarized in Algorithm 1 of the appendix.

In order to generate suitable synthetic traces for ZK MIA, $Adv$ must estimate the marginal distributions $\mathcal{P}_{S},\mathcal{P}_{T},\mathcal{P}_{A}$, computed over the full population $\Omega$, using the aggregate release $\overline{A}^{\mathcal{U}}$. In this section, we motivate and justify the techniques that we developed to obtain strong estimates $\widehat{\mathcal{P}}_{S},\widehat{\mathcal{P}}_{T},\widehat{\mathcal{P}}_{A}$. This task is especially challenging when privacy measures distort the aggregate data. We develop separate techniques to correct for bias in the case of SSC, and to correct for noise in the case of DP. The effects are shown in Figures 4 and 5 respectively. Algorithm 2 in the Appendix summarizes how we approximate all three marginals from $\overline{A}^{\mathcal{U}}$.

When MIAs target high-dimensional aggregate data, such as location data, the membership classifier must handle noise arising from thousands of entries, which are unrelated to the target record. For example, many of the IN training aggregates may coincidentally have high counts in entries that are absent in the target record. This would skew the decision boundary of the membership classifier, which may lead to false positives when testing. We may similarly obtain false negatives due to spurious patterns within the OUT training aggregates. These challenges are compounded by the implementation of privacy measures. For example, $\varepsilon-$DP would add noise to each entry. Given the dimensionality and nature of the aggregate data, spurious patterns will likely skew the decision boundary, even when hundreds or thousands of training aggregates are sampled. Given a fixed number of training samples, we demonstrate that the way in which the training set is sampled strongly influences the performance of the MIA. In particular, the sampling technique can guide the convergence of the decision boundary in order to prevent misclassification due to noise.

To the best of our knowledge, all previous MIAs on aggregate location data sampled their training set via independent random sampling (Pyrgelis et al.,, 2017; Oehmichen et al.,, 2019; Zhang et al.,, 2020; Pyrgelis et al.,, 2020). Training aggregates are created by independently sampling groups of $m$ users from the population $\Omega$ and labeling them according to the target $u^{*}$’s presence.

On the one hand, independent sampling discourages overfitting to the training data by exposing the classifier to a wide variation of samples. On the other hand, independent sampling does nothing to prevent spurious patterns from distorting the decision boundary.

We propose a paired sampling technique to guide the convergence of the decision boundary. The idea is to use sampling to help the classifier identify the differential impact of the target record at the aggregate level. Paired sampling independently samples groups of $m-1$ users from $\Omega\setminus\{u^{*}\}$. Then, an IN sample is created by adding $u^{*}$ as the group’s last member, and an OUT sample is created by adding another randomly selected user. The training set is therefore characterized by a set of IN/OUT pairs, which differ in exactly one record (the target’s). If noise is added to aggregates prior to release, then $Adv$ must inject the same noise sample $\varepsilon$ to each paired sample, $A^{\mathcal{U}^{IN}}$ and $A^{\mathcal{U}^{OUT}}$, to ensure that the target’s differential impact is preserved between each IN/OUT pair.

Paired sampling therefore actively encourages the membership decision boundary to be formed based on relevant criteria related to the target. It also discourages spurious decision boundaries because of the high degree of similarity between IN/OUT pairs. An extreme value in an aggregate entry from an IN sample will be matched with a similar value from its paired OUT sample, with high probability. However, we note that using paired sampling effectively halves the training variation compared to independent sampling. Our experiments in Section 6.4 demonstrate that paired sampling outperforms independent sampling across all tested settings of $\varepsilon$-DP noise addition. Hence, guiding the decision boundary towards relevant membership criteria often takes precedence over maximizing training variation. For completeness, we note that while we developed, studied, and named paired sampling independently, we later found that a similar idea was used in Bauer and Bindschaedler, (2020) but had not been compared to independent sampling nor used elsewhere in the literature so far to the best of our knowledge.

In this section, we describe the two location datasets used for evaluating the MIAs, and discuss ethical considerations of the data collection and usage.

We perform a fair comparison between KK MIA and ZK MIA by training the binary membership classifier using the same parameters and architecture. This also helps us isolate the effect of removing auxiliary data on performance. We use a Logistic Regression binary classifier with default hyperparameters and $\mathbb{L}_{1}$ regularization, implemented with $sklearn$. The number of training groups $n_{train}=400$ matches previous implementations (Pyrgelis et al.,, 2017, 2020), and the groups are selected using paired sampling, unless specified otherwise. We additionally fine tune the decision boundary using $n_{val}=100$ balanced independently sampled validation groups. We flatten the aggregates and feed them directly into the classifier as a vector, without any processing, such as PCA or feature extraction. Finally, as done in Pyrgelis et al., (2017), $Adv$ applies the same privacy measures to training and validation aggregates, if the released aggregate is privacy-aware.

Knock-Knock. To implement the Knock-Knock MIA, we provide $Adv$ with a reference group $Ref$ of $5000$ real user traces (including the target trace $L^{u^{*}}$) when attacking the larger CDR dataset. We set $|Ref|=2500$ for the Milan dataset. We note that this significantly surpasses previous reference sizes ($|Ref|=1100$) implemented by Pyrgelis et al., (2017).

Zero Auxiliary Knowledge.Our Zero Auxiliary Knowledge MIA is structurally identical to KK (PS), but ZK has a synthetic reference $Ref$, rather than a set of real traces. This reference is created according to the methodology detailed in Section 4. Setting $|Ref|=5000$ allows for a direct comparison of the functionality of synthetic traces to real ones for the purpose of the MIA. However, we remark that cap** the number of synthetic traces at $5000$ is an artificial restriction, since $Adv$ may generate arbitrarily more synthetic traces and achieve better performance, as shown in Figure 12 of the Appendix. By default, we assume full access to the target trace $L^{u^{*}}$. This assumption is relaxed for experiment 6.3.

Default Experimental Parameters. We randomly select $n_{targets}=50$ targets from the dataset for evaluation. These targets are re-used for each experiment. Furthermore, in each experiment, $n_{test}=100$ independently sampled balanced test aggregates are created for each target, and shared across both MIAs to ensure that the test sets are identical. As done in  (Pyrgelis et al.,, 2017), the test aggregate user groups are sampled from a disjoint set of users to the Knock-Knock adversarial reference $Ref$, plus the target $u^{*}$. This corresponds to roughly $11,000-5000=6000$ user traces for CDR and $5000-2500=2500$ user traces for Milan.

We perform all experiments on size $m=1000$ aggregates, which matches the largest aggregate size tested in  Pyrgelis et al., (2017) and exceeds the largest aggregate size tested in  Zhang et al., (2020) (800). We do not vary $m$ since the relationship between aggregate group size and MIA effectiveness has already been documented extensively  (Pyrgelis et al.,, 2017, 2020; Zhang et al.,, 2020). We perform the Knock-Knock and Zero Auxiliary Knowledge MIAs in this setting under different privacy measures. We also perform experiments such that $Adv$ only knows a fraction $p_{u^{*}}$ of the target trace $L^{u^{*}}$, but by default, we assume that they know the full trace, i.e. $p_{u^{*}}=1$.

Evaluation Metrics. In the past, MIAs on aggregate location data have been primarily evaluated using the area under the ROC curve (AUC score) as a metric  (Pyrgelis et al.,, 2017; Zhang et al.,, 2020). For this reason, and its suitability for assessing the strength of a binary classifier, we use the mean AUC over all targets as our primary metric. However, we also include the mean attack accuracy over all targets as a secondary metric, listing these scores in Section C of the Appendix.

We first compare the performances of KK and ZK on aggregates whose counts have been suppressed according to threshold $k$. We apply SSC with thresholds $k\in\{0,1,2,3,4,5\}$ on test aggregates of size $m=1000$. We note that the case $k=0$ corresponds to releasing a raw aggregate. We remark that there is a trivial rule that sufficiently determines non-membership in this special case.

Rule ($k=0$): If $u^{*}$ visits ROI $s$ during epoch $t$ and no users in the aggregation group $\mathcal{U}$ visit $(s,t)$, then $u^{*}$ cannot be in $\mathcal{U}$, i.e.,

We therefore incorporate this rule when $k=0$, such that both MIAs first check if the released aggregate elicits the contradiction. If so, we immediately predict OUT. Otherwise, we train, validate, and test the classifier as usual. The rule is invalid for $k>0$, since it would predict OUT whenever $u^{*}$ has a visit to a suppressed entry.

Results. Figure 7 shows that membership inference is a trivial task when applied to raw aggregates ($k=0$). Both ZK and KK achieve near perfect AUC ($\geq 0.99$) on both datasets. This implies that aggregation is not an effective privacy mechanism in itself to protect high-dimensional location data from MIAs by weak or strong adversaries.

The results for $k>0$ reveal two general patterns. First, ZK compares closely with KK across different levels of SSC. On the CDR dataset, ZK’s AUC stays within $0.02$ of KK for each $k$. We observe slightly worse results on the Milan dataset, but ZK still stays within $0.9$ AUC of KK for each $k$. Second, there is a monotonic decrease in performance when the threshold $k$ is increased. For $k=5$, the AUC is always less than $0.55$. This follows from the fact that suppression reduces the amount of available information, and $99\%$ of all nonzero entries are suppressed by $k=5$, as shown in Figure 15 of the Appendix. Therefore, although SSC eventually mitigates the MIAs, it may come at the cost of destroying virtually all utility.

Both MIAs perform worse on the Milan dataset compared to the CDR dataset. This is expected because we observe  $6$ times less data per target in the Milan dataset, as shown in Figure 14. Indeed, people generally tweet less often than they text and call. ZK MIA is more affected by dataset sparsity, given its dependence on marginal distribution estimates, which become less reliable in sparser datasets.

Informed by practical applications of DP  (Desfontaines,, 2021), we consider event level and user-day level to be the privacy units, and we vary the privacy budget $\varepsilon\in\{0.1,0.5,1.0,5.0,10.0\}$ for each unit.

Event Level DP. An event is equivalent to a visit by a user to $(s,t)\in\mathcal{S}\times\mathcal{T}$. To offer privacy protection over an event, we set the global sensitivity $\Delta=1$. $\epsilon$-DP is then ensured by adding $Lap(\frac{1}{\epsilon})$ noise to each count in the aggregate matrix.

User-day Level DP. In order to protect each user’s daily contributions without adding excessive noise, it is common to restrict user contributions prior to aggregation to achieve a smaller global sensitivity $\Delta$  (Aktay et al.,, 2020; Herdağdelen and Dow,, 2021). We analysed daily activity distributions, and had them preprocessed such that a user may only contribute up to $\Delta=20$ visits in any given day for CDR, and $\Delta=10$ visits in any given day for Milan. $\epsilon$-DP at the user-day level is then ensured by adding $Lap(\frac{\Delta}{\epsilon})$ noise to each count in the aggregate matrix.

Results. Figure 8 shows that ZK MIA matches KK MIA across all tested DP settings. Indeed, ZK maintained a mean AUC within $0.06$ of KK (PS) across each of the $10$ privacy settings for both datasets. KK and ZK notably succeeded for many of the tested privacy budgets $\varepsilon$, particularly in the event level setting. Indeed, we observed $AUC\geq 0.9$ for both MIAs whenever the noise scale $\frac{\Delta}{\epsilon}\leq 2$ for the CDR dataset, and $\frac{\Delta}{\epsilon}\leq 1$ for the Milan dataset. These settings are in line with many real-life applications (Kohli et al.,, 2023; Desfontaines,, 2021). Conversely, user-day level DP with privacy budget $\varepsilon\leq 1.0$ effectively reduced both MIAs to an AUC below $0.55$. We discuss the significance of these results with respect to practical mitigations in Section 7.

We now relax the assumption that $Adv$ knows the full target trace $L^{u^{*}}$. This is in line with our ZK threat model, and we expand KK MIA for this setting to be able to compare methods. To simulate a weaker adversary, we suppose that $Adv$ only knows a subset of the target $u^{*}$’s visits. We assume that $Adv$ only knows a random fraction $p_{u^{*}}\in\{0.1,0.25,0.5,0.75,1.0\}$ of the trace $L^{u^{*}}$. The number of retained visits is rounded up to the next integer to prevent cases where $Adv$ knows $0$ visits. For example, if a target has $4$ visits and $p_{u^{*}}=0.1$, then this would correspond to $Adv$ knowing $1$ visit. This partial trace is used instead of the full trace when creating IN training and validation aggregates. The full trace $L^{u^{*}}$ is still used for IN test aggregates.

We perform this experiment in the setting where the data collector applies event-level DP with $\epsilon=1$, followed by $k=1$ suppression. We choose this setting for a couple of reasons. First, to study the degradation of the MIAs with decreasing information about the target, we choose a setting where $Adv$ would succeed given the full target trace. Previous experiments revealed that $\epsilon=1$-DP at the event level and $k=1$ suppression were not effective in preventing the MIAs by themselves, as the MIAs achieved AUC $>0.97$ on the CDR dataset and AUC $>0.9$ for Milan. Second, we combine the two defense mechanisms to see if suppression has an observable mitigation effect when applied following DP noise addition. By the post-processing property of DP, this would not alter the theoretical performance bound. However, zeroing all counts $\leq 1$ might add a layer of complexity that affect MIAs in practice.

Results. First, we note that applying $k=1$ SSC on top of $\varepsilon=1.0$ event level DP has an insignificant effect on the MIAs. For the full target trace, we continue to observe AUC $>0.97$ on the CDR dataset and AUC $>0.9$ on the Milan dataset. The only MIA with a noticeable decline was KK MIA on the Milan dataset, which dropped from $0.97$ AUC to $0.9$ AUC.

Although decreasing the fraction of the target trace known to the adversary from $1$ to $0.1$ decreases the performance of the MIAs, the corresponding degradation is relatively gradual. All AUCs are captured within a range of $0.13$ on the CDR dataset, and within a range of $0.22$ on the Milan dataset. Even the lowest observed AUC by ZK MIA on the CDR dataset ($0.84$ when $10\%$ of the target trace is known) achieves high discrimination. We note that the $50$ targets in both datasets have a wide variation in trace size, as shown in Figure 14 of the Appendix. For some targets, $Adv$ will only know one of the target’s visits, whereas for others, they will still know dozens and be able to infer membership easily. Interestingly, we note that knowing a single visit from a target trace can still train a classifier that is better than random. For one CDR target with $9$ visits in their full trace, we observed ZK achieve an AUC of $0.660$ across $100$ aggregates when only $1$ random visit was known. Although far from perfect, we found this surprising, as it shows that even a single visit by the target can inform an MIA against a noisy aggregate over $1000$ users.