do not prevent users from attribute inference attacks where an attacker seeks to illegitimately ob-
tain their personal attributes (such as gender) from publicly available information.
Disclosure of personal information can have serious outcomes such as personal spam, bullying,
profile cloning for malicious activities, or sexual harassment. Existing inference techniques are
either based on the target user behavior analysis through their liked pages and group member-
ships or based on the target user friend list. However, in real cases, the amount of available
information to an attacker is small since users have realized the vulnerability of standard at-
tribute inference attacks and concealed their generated information. To increase awareness of
OSN users about threats to their privacy, in this thesis, we introduce a new class of attribute
inference attacks against OSN users. We show the feasibility of these attacks from a very limited
amount of data. They are applicable even when users hide all their profile information and their
own comments. Our proposed methodology is to analyze Facebook picture metadata, namely
(i) alt-text generated by Facebook to describe picture contents, and (ii) commenters’ words and
emojis preferences while commenting underneath the picture, to infer sensitive attributes of the
picture owner. We show how to launch these inference attacks on any Facebook user by i) han-
dling online newly discovered vocabulary using a retrofitting process to enrich a core vocabulary
that was built during offline training and ii) computing several embeddings for textual units
(e.g., word, emoji), each one depending on a specific attribute value. Finally, we introduce a
protection mechanism that selects comments to be hidden in a computationally efficient way
while minimizing utility loss according to a semantic measure. The proposed mechanism can
help end-users to check their vulnerability to inference attacks and suggests comments to be
hidden in order to mitigate the attacks. We have determined the success of the attacks and the
protection mechanism by experiments on real data.