diff --git a/README.md b/README.md
index 4119a39..6feb401 100755
--- a/README.md
+++ b/README.md
@@ -175,6 +175,8 @@ Reconstruction attacks cover also attacks known as *model inversion* and *attrib
 - [**Property Inference Attacks on Convolutional Neural Networks: Influence and Implications of Target Model's Complexity**](https://arxiv.org/abs/2104.13061) (Parisot et al., 2021)
 - [**Honest-but-Curious Nets: Sensitive Attributes of Private Inputs can be Secretly Coded into the Entropy of Classifiers' Outputs**](https://arxiv.org/abs/2105.12049) (Malekzadeh et al. 2021) ([code](https://github.com/mmalekzadeh/honest-but-curious-nets))
 - [**Property Inference Attacks Against GANs**](https://arxiv.org/abs/2111.07608) (Zhou et al., 2021) ([code](https://github.com/Zhou-Junhao/PIA_GAN))
+- [**Formalizing and Estimating Distribution Inference Risks**](https://arxiv.org/pdf/2109.06024.pdf) (Suri et al., 2022) ([code](https://github.com/iamgroot42/FormEstDistRisks))
+
 
 ## Model extraction
 - [**Stealing machine learning models via prediction apis**](https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_tramer.pdf) (Tramèr et al., 2016) ([code](https://github.com/ftramer/Steal-ML))