Research map / Federated learning and privacy / Privacy attacks and secure learning
FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FedMIA, a server-side membership inference attack for federated learning that uses non-target clients' updates across rounds to estimate the non-member distribution and run a one-tailed likelihood-ratio test.
Problem
Membership inference against clients in federated learning, where existing attacks use only the target client's updates and ignore information from non-target clients, or require auxiliary shadow-model data.
Approach
Estimate the distribution of non-member update measurements from non-target clients' uploads (after 3-sigma outlier filtering) per round, then apply a one-tailed likelihood-ratio test on the target client's measurement and average over all communication rounds.
Key results
- On AlexNet-CIFAR100, FedMIA-II reaches TPR@FPR=0.1% of 66.98±1.74% versus 54.66±1.22% for the next best method (Avg-Cosine).
- On AlexNet-DermNet, FedMIA-II achieves TPR@FPR=0.1% of 62.27±0.23% versus 41% for the best baseline.
- FedMIA-II keeps the strongest attack effect across Non-IID settings (e.g., 83.14% vs 68.97% at beta=1 on AlexNet-CIFAR100), though on ResNet18-DermNet FedMIA's AUC (0.62-0.64) trails Grad-Diff (0.66).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FedMIA-II instead of Avg-Cosine | AlexNet · CIFAR100 | TPR@FPR=0.1%: 54.66±1.22 -> 66.98±1.74 | Helped |
| Use FedMIA-II instead of Avg-Cosine | AlexNet · DermNet | TPR@FPR=0.1%: 41±0.48 -> 62.27±0.23 | Helped |
| Use FedMIA-II instead of Avg-Cosine | ResNet18 · CIFAR100 | TPR@FPR=0.1%: 44.02±1.58 -> 68.74±1.84 | Helped |
| Use FedMIA-I instead of Loss-Series | ResNet18 · DermNet | TPR@FPR=0.1%: 32.2±0.89 -> 35.6±0.96 | Helped |
| Use FedMIA-II instead of Loss-Series | ResNet18 · DermNet | TPR@FPR=0.1%: 32.2±0.89 -> 31.8±0.88 | No clear effect |
| Use FedMIA-II instead of Grad-Cosine | Diffusion Model · Tiny-ImageNet | TPR@FPR=0.1%: 2.40±0.60 -> 4.50±0.20 | Helped |
| Use FedMIA-II instead of Avg-Cosine | Diffusion Model · CIFAR100 | TPR@FPR=0.1%: 1.80±0.10 -> 3.0±0.20 | Helped |
Surprising findings
- Conventional defenses such as gradient perturbation, sparsification, and mixup are reported to be ineffective against FedMIA, which exploits cross-client information patterns.
- Attack success increases with non-IID severity, since a client with few classes makes membership inference easier.
Limitations
- Relies on Gaussian assumption for non-member measurement distribution and a 3-sigma filter heuristic.
- Attack effectiveness on the generative diffusion task remains low (TPR around 3-4.5% at FPR 0.1%).
- Secure aggregation (MPC/HE) is noted as blocking the attack but at high computational cost, so it was not evaluated as a defense.
Experimental setup
Datasets: CIFAR-100 DermNet Tiny-ImageNet
Benchmarks: CIFAR-100 DermNet Tiny-ImageNet
Metrics: TPR@FPR=0.1% AUC hypervolume
Baselines: Blackbox-Loss Grad-Cosine Grad-Norm Loss-Series Avg-Cosine Grad-Diff
Builds on: Likelihood-ratio test (LiRA-style hypothesis testing) Grad-Cosine MIA (Li et al.) FedAvg FedEmbedding
Closest papers by meaning
- Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning (NeurIPS 2026 · similarity 0.91)
- Attribute Inference Attacks for Federated Regression Tasks (AAAI 2025 · similarity 0.88)
- Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models (ICML 2025 · similarity 0.88)
- Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning (ICLR 2024 · similarity 0.87)
- Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.87)
- Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.