Research map / Federated learning and privacy / Privacy attacks and secure learning
EMGAN: Early-Mix-GAN on Extracting Server-Side Model in Split Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EMGAN, a gradient-query model extraction attack on split federated learning during training, combining an early-learner surrogate, MultiGAN generator pool, and ProperMix augmentation.
Problem
Extracting the server-side model of split federated learning via gradient queries when the target model is changing during training-from-scratch, where prior gradient-based attacks fail due to inconsistent gradients.
Approach
Train the surrogate from the start of SFL training using conditional GAN-generated and mixed samples, with a pool of generators (MultiGAN) for randomness and a clipped, randomly weighted mixing of synthetic and real data (ProperMix) to keep samples in distribution.
Key results
- With 50 CIFAR-10 training samples, EMGAN reaches 83.65% surrogate accuracy vs 71.71% for Train-ME (target 90.06-90.5%).
- Data-free EMGAN reaches 81.25% surrogate accuracy on CIFAR-10 vs 45.45% for GAN-ME.
- Under 10 clients with 0.5 sampling, EMGAN with 0.1% data reaches 87.93% surrogate accuracy.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use EMGAN instead of Train-ME | VGG-11 extraction · CIFAR-10, 50 training samples | surrogate model accuracy: 71.71% -> 83.65% | Helped |
| use EMGAN instead of GAN-ME | VGG-11 extraction · CIFAR-10, no training data | surrogate model accuracy: 45.45% -> 81.25% | Helped |
| add Early Learner to Train-ME (ablation) | VGG-11 extraction · CIFAR-10, 50 training samples | surrogate model accuracy: 71.71% -> 76.45% | Helped |
| add GAN to Early Learner (ablation) | VGG-11 extraction · CIFAR-10, 50 training samples | surrogate model accuracy: 76.45% -> 79.47% | Helped |
| add MultiGAN to Early Learner + GAN (ablation) | VGG-11 extraction · CIFAR-10, 50 training samples | surrogate model accuracy: 79.47% -> 80.53% | Helped |
| add ProperMix to MultiGAN (ablation) | VGG-11 extraction · CIFAR-10, 50 training samples | surrogate model accuracy: 80.53% -> 83.65% | Helped |
| add Early Learner to GAN-ME (ablation) | VGG-11 extraction · CIFAR-10, no training data | surrogate model accuracy: 45.45% -> 74.06% | Helped |
| add MultiGAN to Early Learner (ablation) | VGG-11 extraction · CIFAR-10, no training data | surrogate model accuracy: 74.06% -> 75.45% | Helped |
| add ProperMix to MultiGAN (ablation) | VGG-11 extraction · CIFAR-10, no training data | surrogate model accuracy: 75.45% -> 81.25% | Helped |
Surprising findings
- Data-free EMGAN outperforms with-data EMGAN under strong Non-IID client distributions (e.g., 65.47% vs 19.49% at Non-IID degree 0.2).
Limitations
- Weaker attack performance as the number of classes increases.
- Weaker attack performance when the server-side model has many layers.
- Loss-based gradient dispatching defense is ineffective when benign clients also have little data.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN ImageNet-12
Benchmarks: CIFAR-10 CIFAR-100 SVHN ImageNet-12
Metrics: surrogate model accuracy label agreement (fidelity)
Baselines: Train-ME GAN-ME Craft-ME GM-ME SoftTrain-ME
Builds on: Train-ME GAN-ME Mixup MultiGAN SFL-V1
Closest papers by meaning
- FSL-SAGE: Accelerating Federated Split Learning via Smashed Activation Gradient Estimation (ICML 2025 · similarity 0.86)
- Convergence Analysis of Split Federated Learning on Heterogeneous Data (NeurIPS 2024 · similarity 0.85)
- GAS: Generative Activation-Aided Asynchronous Split Federated Learning (AAAI 2025 · similarity 0.84)
- Virtual Nodes Can Help: Tackling Distribution Shifts in Federated Graph Learning (AAAI 2025 · similarity 0.84)
- F^3OCUS - Federated Finetuning of Vision-Language Foundation Models with Optimal Client Layer Updating Strategy via Multi-objective Meta-Heuristics (CVPR 2025 · similarity 0.83)
- FedQS: Optimizing Gradient and Model Aggregation for Semi-Asynchronous Federated Learning (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.