Research map / Federated learning and privacy / Privacy attacks and secure learning

Task-Agnostic Privacy-Preserving Representation Learning for Federated Learning against Attribute Inference Attacks

AAAI 2024 · Federated learning and privacy › Privacy attacks and secure learning · approach: Private federated aggregation · 10 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes TAPPFL, a task-agnostic federated representation learning method that uses two mutual-information objectives (CLUB-style upper bound for attribute privacy, JSD-based lower bound for utility) to defend against attribute inference attacks, with a worst-case privacy bound.

Problem

Federated learning leaks sensitive attributes (e.g., race, gender, income) to an honest-but-curious server via shared models; existing defenses need the FL task in advance, incur high computation or utility loss, or lack provable privacy guarantees.

Approach

Learn per-device feature extractors that minimize an upper bound on mutual information between representation and private attribute (vCLUB) while maximizing a JSD-estimated lower bound on information about the raw input given the attribute, without knowing the primary task; derive a utility-privacy tradeoff and a worst-case attribute inference accuracy bound.

Key results

• On Loans, TAPPFL at lambda=0.5 keeps test accuracy 0.88 while reducing race inference accuracy from 0.74 to 0.70; at lambda=1 inference accuracy falls to 0.57 (near 0.5 random guess) with test accuracy 0.82.
• Against task-agnostic defenses matched on attribute inference accuracy, TAPPFL is reported to be significantly better than DP-Gaussian, DP-Laplace and model compression on CIFAR-10.
• Compared with DPFE on Loans at the same test accuracy of 0.84, TAPPFL's attribute inference accuracy is 0.63 versus DPFE's 0.77.

Measured effects reported in the paper

Surprising findings

• Task-specific adversarial training (AT) achieves a slightly better tradeoff (0.86, 0.63) than TAPPFL (0.84, 0.63) on Loans, which the authors attribute to AT using task labels.
• Against the de-censoring representation attack, the attack's inference accuracy rises to 0.73 at a test accuracy of 0.84 without extra privacy protection, showing the attack is stronger than the baseline attacker.

Limitations

• Theory is restricted to binary attributes and binary primary classification; multi-value attributes and multi-class tasks are left to future work.
• Experiments use relatively small-scale setups (100 simulated devices, three datasets), and the privacy bound is stated for the optimal representation rather than practical training.
• Adversarial-style training with three networks per device adds training cost compared with simple defenses.

Experimental setup

Datasets: CIFAR-10 Loans Adult Income

Benchmarks: CIFAR-10 Loans Adult Income

Metrics: test accuracy attribute inference accuracy gap to random guessing mutual information loss (CE and JSD)

Baselines: DP-Gaussian DP-Laplace model compression DPFE adversarial training de-censoring representation attack

Builds on: CLUB FedAvg MINE DPFE

Closest papers by meaning

• Attribute Inference Attacks for Federated Regression Tasks (AAAI 2025 · similarity 0.86)
• Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models (ICML 2025 · similarity 0.86)
• Data Valuation and Detections in Federated Learning (CVPR 2024 · similarity 0.85)
• Little Is Enough: Boosting Privacy by Sharing Only Hard Labels in Federated Semi-Supervised Learning (AAAI 2025 · similarity 0.85)
• DictPFL: Efficient and Private Federated Learning on Encrypted Gradients (NeurIPS 2025 · similarity 0.85)
• FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning (CVPR 2025 · similarity 0.85)