Research map / Federated learning and privacy / Privacy attacks and secure learning
Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives theoretical lower bounds on success rates of low-polynomial-time active membership inference attacks (FC-layer and self-attention based) against LDP-protected client data in federated vision models, and shows attacks remain effective at privacy budgets where utility degrades substantially.
Problem
Active membership inference by a dishonest FL server against clients whose data is protected by local differential privacy lacks theoretical guarantees on attack success; it is unclear how much LDP actually mitigates such attacks in federated vision models.
Approach
Extends the provable low-polynomial-time FC-layer and attention-layer active MIAs (previously analyzed only without LDP) to LDP-perturbed inputs, deriving lower and upper bounds on attack advantage as functions of privacy budget epsilon, dataset size, and mechanism-dependent probabilities, and extends the attention attack from LLM token patterns to ViT patch embeddings.
Key results
- FC-based attack on BitRand-protected CIFAR10 reaches near 100% empirical success at epsilon=8, and the noise needed to keep inference below 80% costs at least 20% accuracy.
- For GRR, RAPPOR, and dBitFlipPM on CIFAR datasets, attack success approaches 100% at epsilon around 5 to 6.
- Attention-based attack on ViT-B-32 against LDP-protected CIFAR10 and ImageNet approaches 100% success for epsilon of 3 or higher, where model performance suffers significantly.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply BitRand LDP noise sufficient to reduce inference rate below 80% | CIFAR10 with FC-based AMI · CIFAR10 | model accuracy: at least 20% accuracy loss | Hurt |
| Use FC-based AMI against BitRand-protected data at ε = 8 | CIFAR10 · CIFAR10, BitRand | attack success rate: ≈ 100% | Helped |
| Use FC-based AMI on LDP-protected data as ε approaches 6 | CIFAR10 and CIFAR100 · CIFAR10 and CIFAR100 | attack success rate: near 100% | Helped |
| Use Attention-based AMI when ε is 3 or higher | ViT vision models · CIFAR10 and ImageNet | attack success rate: approaches 100% | Helped |
| Increase LDP noise on attention-attack inputs | Attention-based AMI on spherical data · Synthetic spherical data | attack advantage | Hurt |
| Increase β | Attention-based AMI on LDP-protected data · LDP-protected data | attack success rate | Hurt |
| Set β to 0.01 | Attention-based AMI · Small ε across realistic datasets and LDP mechanisms | attack success rate: β=0.01 | Helped |
| Vary batch size | Attention-based AMI on BitRand-protected data · BitRand-protected data | attack success rate | No clear effect |
Surprising findings
- Increasing the attention hyperparameter beta, which helps the attack on unprotected data, reduces the theoretical lower bound under LDP.
- Attack success on LDP-protected data is high at small epsilon for attention-based attacks, despite noise, so LDP offers weak protection against active servers in these settings.
Limitations
- Theoretical analysis assumes continuous patterns and i.i.d. noise; NLP data is discrete so the theory does not directly apply.
- Attention-based theoretical bound depends on hard-to-obtain separation Delta^epsilon and requires large enough beta, and attack success drops at high noise levels.
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNet IMDB Yelp Twitter Finance one-hot synthetic data spherical synthetic data
Benchmarks: CIFAR10 CIFAR100 ImageNet IMDB Yelp Twitter Finance
Metrics: attack success rate attack advantage model accuracy
Baselines: BitRand GRR RAPPOR dBitFlipPM OME
Builds on: Active membership inference attack in FL (Wen et al.) Low-polynomial-time FC and attention AMI attacks on LLMs Hopfield-based attention memorization Generalized randomized response BitRand
Closest papers by meaning
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.88)
- Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning (NeurIPS 2025 · similarity 0.88)
- FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning (CVPR 2025 · similarity 0.88)
- Clients Collaborate: Flexible Differentially Private Federated Learning with Guaranteed Improvement of Utility-Privacy Trade-off (ICML 2025 · similarity 0.87)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.87)
- One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.