Research map / Federated learning and privacy / Privacy attacks and secure learning

Attribute Inference Attacks for Federated Regression Tasks

AAAI 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes model-based attribute inference attacks for federated regression that first approximate the client's optimal local model (passively via eavesdropped messages in least squares, or actively by manipulating the global model with an Adam-emulating procedure) and then apply model-based AIA.

Problem

Attribute inference attacks against federated learning have been studied mainly for classification; their accuracy collapses on regression tasks, so privacy leakage for federated regression is poorly quantified.

Approach

Model-based AIA (argmin of loss over candidate sensitive values) becomes stronger when the model overfits the client's data, so the adversary first reconstructs the client's optimal local model from exchanged messages (passive, via least-squares inversion of FedAvg updates) or by actively sending crafted models and emulating Adam, then runs the model-based AIA on it.

Key results

• On Medical, the passive model-based attack reaches 95.90% AIA accuracy versus 87.26% for passive Grad.
• On Income-A with 50 active rounds, the proposed attack reaches 78.09% versus 53.36% for Grad.
• On Income-L, the passive model-based attack achieves 75.27% versus 60.36% for Grad, and the model-with-oracle upper bound reaches 94.31%.

Measured effects reported in the paper

Surprising findings

• Gradient-based AIA accuracy drops from about 71% on a classification task to random guess (50%) on the regression task once clients hold more than 256 points.
• Preliminary experiments suggest the superiority of model-based over gradient-based attacks is inverted for classification tasks, since model-based AIA reduces to label-based inference with binary cross-entropy.

Limitations

• Exact optimal-local-model reconstruction is proven only for linear least squares; for neural networks the passive approach uses the last returned model.
• Theoretical assumption that the global model is independent of the target client's previous stochastic gradients is not strictly satisfied.
• Defenses beyond DP-SGD (e.g., Mixup, TAPPFL) are not evaluated on regression tasks.

Experimental setup

Datasets: Medical insurance charges dataset Income-L (ACS Income, Louisiana) Income-A (ACS Income, 51 census regions)

Benchmarks: Medical Income-L Income-A

Metrics: AIA accuracy

Baselines: Grad Grad-w-O

Builds on: FedAvg gradient-based AIA (cosine similarity pseudo-gradients) Adam DP-SGD

Closest papers by meaning

• FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning (CVPR 2025 · similarity 0.88)
• Task-Agnostic Privacy-Preserving Representation Learning for Federated Learning against Attribute Inference Attacks (AAAI 2024 · similarity 0.86)
• Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning (NeurIPS 2026 · similarity 0.86)
• Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.86)
• FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.86)
• FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.85)