Research map / Federated learning and privacy / Personalized and heterogeneous FL
Personalized Label Inference Attack in Federated Transfer Learning via Contrastive Meta Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CML, a label inference attack on federated transfer learning with parameter decoupling (FedRep) that combines a meta-classifier over layer outputs with contrastive learning on pre/post fine-tuning model differences.
Problem
Label inference privacy risk in federated transfer learning under parameter decoupling strategies, where existing label inference attacks (ULIA, CLIA) fail because personalized heads are not shared and the global body is averaged.
Approach
An honest-but-curious server trains a meta-classifier on per-layer outputs of the uploaded body model and adds a triplet-style contrastive encoder that separates the client's fine-tuned model from the broadcast global model, plus posterior-difference features, to infer private labels using shadow data.
Key results
- On CIFAR-10 at round 6 with alpha=0.1, CML attack achieves 67.86% ASR for client 0 and 79.11% for client 10, versus 26.71% for ULIA and 37.53% for CLIA.
- Meta classifier alone reaches about 61-77% ASR across alpha settings, outperforming CLIA and ULIA under FedRep.
- Under differential privacy with epsilon=1.2, CML ASR drops only from 67.86% to 59.31% (alpha=0.1) while FedRep accuracy falls from 87.76% to 68.41%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace CLIA with the meta-classifier attack (ablation) | Label inference attack on FedRep · CIFAR-10, α=0.5, client 0 | ASR: 37.49 -> 74.28 | Helped |
| Add posterior difference directly to the meta-extractor (ablation) | Meta-classifier attack on FedRep · CIFAR-10, α=0.1, client 0 | ASR: 61.23 -> 61.91 | Helped |
| Add contrastive learning to the meta-classifier and posterior-difference attack (ablation) | CML attack on FedRep · CIFAR-10, α=0.1, client 0 | ASR: 61.91 -> 67.86 | Helped |
| Add contrastive learning to the meta-classifier and posterior-difference attack (ablation) | CML attack on FedRep · CIFAR-10, α=0.1, client 10 | ASR: 77.26 -> 79.11 | Helped |
| Add contrastive learning to the meta-classifier and posterior-difference attack (ablation) | CML attack on FedRep · CIFAR-10, α=0.3, client 0 | ASR: 63.03 -> 68.55 | Helped |
| Add contrastive learning to the meta-classifier and posterior-difference attack (ablation) | CML attack on FedRep · CIFAR-10, α=0.5, client 0 | ASR: 74.30 -> 77.15 | Helped |
| Increase differential-privacy noise from epsilon=0 to epsilon=0.5 | CML attack on FedRep · CIFAR-10, α=0.1, client 0 | ASR: 67.86 -> 62.11 | Hurt |
| Increase differential-privacy noise from epsilon=0 to epsilon=1.2 | CML attack on FedRep · CIFAR-10, α=0.1, client 0 | ASR: 67.86 -> 59.31 | Hurt |
Surprising findings
- Existing label inference attacks (ULIA, CLIA) perform worse under FedRep than under FedAvg, with ASR falling as heterogeneity increases.
- Attack effectiveness is only reduced by about 5% under DP noise that substantially degrades model utility.
Limitations
- Evaluated only on CIFAR-10/100 with AlexNet under FedRep; generalization to other architectures and FTL methods is untested.
- Attack relies on attacking early rounds because contrastive differences vanish as training converges.
- No effective defense is proposed; defense exploration is left for future work.
Experimental setup
Datasets: CIFAR-10 CIFAR-100
Benchmarks: CIFAR-10 CIFAR-100
Metrics: attack success rate (ASR) training accuracy
Baselines: ULIA CLIA Meta classifier Meta classifier + diff
Builds on: FedRep Complementary Label Inference Attack (CLIA) Salem et al. update-based attack (ULIA) MOON Nasr et al. white-box membership inference
Closest papers by meaning
- Little Is Enough: Boosting Privacy by Sharing Only Hard Labels in Federated Semi-Supervised Learning (AAAI 2025 · similarity 0.88)
- (FL)$^2$: Overcoming Few Labels in Federated Semi-Supervised Learning (NeurIPS 2024 · similarity 0.86)
- Recovering Labels from Local Updates in Federated Learning (ICML 2024 · similarity 0.86)
- FedSC: Provable Federated Self-supervised Learning with Spectral Contrastive Objective over Non-i.i.d. Data (ICML 2024 · similarity 0.85)
- A Bayesian Approach for Personalized Federated Learning in Heterogeneous Settings (NeurIPS 2024 · similarity 0.85)
- FedFixer: Mitigating Heterogeneous Label Noise in Federated Learning (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.