The privacy issue of counterfactual explanations: explanation linkage attacks

Explainability can create new privacy vulnerabilities: The paper identifies "explanation linkage attacks" as a previously underrecognized privacy risk that emerges specifically when using counterfactual explanations—a common XAI technique used to show how changing input features would alter a model's decision. This means that the very tools designed to make AI more transparent can inadvertently expose sensitive information.

Attackers can use explanations to re-identify individuals: The explanation linkage attack allows adversaries to link counterfactual explanations back to specific individuals in the original dataset, potentially revealing private information about real people. This is particularly concerning in high-stakes domains like healthcare, finance, and criminal justice where the paper notes these explainable models are increasingly deployed.

A practical solution exists without sacrificing explanation quality: The researchers propose "k-anonymous counterfactual explanations" as a defense mechanism, which protects privacy by ensuring explanations cannot be uniquely linked to individuals. Importantly, their findings show that applying privacy protections to the explanations themselves—rather than restricting the entire dataset—maintains better explanation quality while still providing privacy safeguards.

Privacy and explainability require deliberate trade-off management: The paper introduces "pureness" as a new metric to evaluate privacy-protected explanations, highlighting that responsible AI deployment requires actively measuring and balancing competing goals. Organizations cannot assume that transparency and privacy are automatically compatible.