Efficient passive membership inference attack in federated learning

Abstract

In cross-device federated learning (FL) setting, clients such as mobiles cooperate with the server to train a global machine learning model, while maintaining their data locally. However, recent work shows that client's private information can still be disclosed to an adversary who just eavesdrops the messages exchanged between the client and the server. For example, the adversary can infer whether the client owns a specific data instance, which is called a passive membership inference attack [9]. In this paper, we propose a new passive inference attack that requires much less computation power and memory than existing methods. Our empirical results show that our attack achieves a higher accuracy on CIFAR100 dataset (more than 4 percentage points) with three orders of magnitude less memory space and five orders of magnitude less calculations.

PPA: Preference Profiling Attack Against Federated Learning

“…Nasr et al [34] designed a white-box membership inference attack against centralized and FL by exploiting the vulnerability of stochastic gradient descent algorithm. Zari et al [57] also demonstrated the passive membership inference attack in FL. Chen et al [8] provided a generic membership inference attack to attack the deep generative models and judged whether the image belongs to the victim's training set by devising a calibration technique.…”

“…In FL, there have been great efforts to explore its privacy leakage through various inference attacks, including membership inference [34], [57], property inference [32] and GAN [19], [50]. These inference attacks can obtain a variety of user privacy information from the local model.…”

Enhanced Adversarial Attack Resilience in Energy Networks through Energy and Privacy Aware Federated Learning

“…Attacker's Capabilities: Attackers in FL-aided energy networks possess different abilities that can be broadly divided into two types: passive and active [81]. Passive attacks are when the attacker just watches the communication between the clients and the server without messing with it.…”

PPA: Preference Profiling Attack Against Federated Learning

“…In FL, there have been great efforts to explore its privacy leakage through various inference attacks, including membership inference [32,54], property inference [30] and GAN [18,47]. These inference attacks can obtain a variety of user privacy information from the upload model.…”