# Efficient passive membership inference attack in federated learning

arXiv: https://arxiv.org/abs/2111.00430 · HTML: https://mlsanity.com/paper/2111.00430/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security.
- Builds on 12 of its 17 references that are in the map.
- First posted on arXiv 31 Oct 2021.

## Placed in

- LLM safety and security / [Federated unlearning and poisoning](https://mlsanity.com/safety/federated-unlearning-and-poisoning/)

## Builds on (most cited first, 12 of 12)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Federated Optimization in Heterogeneous Networks](https://mlsanity.com/paper/1812.06127/) (2018)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [Inverting Gradients -- How easy is it to break privacy in federated learning?](https://mlsanity.com/paper/2003.14053/) (2020)
- [Exploiting Unintended Feature Leakage in Collaborative Learning](https://mlsanity.com/paper/1805.04049/) (2018)
- [iDLG: Improved Deep Leakage from Gradients](https://mlsanity.com/paper/2001.02610/) (2020)
- [Time Series Classification from Scratch with Deep Neural Networks: A Strong Baseline](https://mlsanity.com/paper/1611.06455/) (2016)
- [See through Gradients: Image Batch Recovery via GradInversion](https://mlsanity.com/paper/2104.07586/) (2021)
- [Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning](https://mlsanity.com/paper/1812.00535/) (2018)
- [Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifiers](https://mlsanity.com/paper/1306.4447/) (2013)
- [Data and Model Dependencies of Membership Inference Attack](https://mlsanity.com/paper/2002.06856/) (2020)

## Built on by (most cited first, 16 of 16)

- [Membership Inference Attacks and Defenses in Federated Learning: A Survey](https://mlsanity.com/paper/2412.06157/) (2024)
- [A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiency](https://mlsanity.com/paper/2307.10655/) (2023)
- [The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape](https://mlsanity.com/paper/2405.03636/) (2024)
- [FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning](https://mlsanity.com/paper/2402.06289/) (2024)
- [PPA: Preference Profiling Attack Against Federated Learning](https://mlsanity.com/paper/2202.04856/) (2022)
- [Exploring the Vulnerabilities of Federated Learning: A Deep Dive into Gradient Inversion Attacks](https://mlsanity.com/paper/2503.11514/) (2025)
- [Towards Sparsified Federated Neuroimaging Models via Weight Pruning](https://mlsanity.com/paper/2208.11669/) (2022)
- [Low-Cost Privacy-Preserving Decentralized Learning](https://mlsanity.com/paper/2403.11795/) (2024)
- [Subject Data Auditing via Source Inference Attack in Cross-Silo Federated Learning](https://mlsanity.com/paper/2409.19417/) (2024)
- [RecUP-FL: Reconciling Utility and Privacy in Federated Learning via User-configurable Privacy Defense](https://mlsanity.com/paper/2304.05135/) (2023)
- [Flexible Differentially Private Vertical Federated Learning with Adaptive Feature Embeddings](https://mlsanity.com/paper/2308.02362/) (2023)
- [Privacy-Preserving Heterogeneous Federated Learning for Sensitive Healthcare Data](https://mlsanity.com/paper/2406.10563/) (2024)
- [SoK: Challenges in Tabular Membership Inference Attacks](https://mlsanity.com/paper/2601.15874/) (2026)
- [ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation](https://mlsanity.com/paper/2602.08617/) (2026)
- [An Efficient Gradient-Based Inference Attack for Federated Learning](https://mlsanity.com/paper/2512.15143/) (2025)
- [A Data-Free Membership Inference Attack on Federated Learning in Hardware Assurance](https://mlsanity.com/paper/2604.19891/) (2026)

## Abstract (arXiv)

In cross-device federated learning (FL) setting, clients such as mobiles cooperate with the server to train a global machine learning model, while maintaining their data locally. However, recent work shows that client's private information can still be disclosed to an adversary who just eavesdrops the messages exchanged between the client and the server. For example, the adversary can infer whether the client owns a specific data instance, which is called a passive membership inference attack. In this paper, we propose a new passive inference attack that requires much less computation power and memory than existing methods. Our empirical results show that our attack achieves a higher accuracy on CIFAR100 dataset (more than 4 percentage points) with three orders of magnitude less memory space and five orders of magnitude less calculations.