mlsanityData to 7 Oct 2026

PPA: Preference Profiling Attack Against Federated Learning

arXiv 2202.04856 ↗First posted 10 Feb 2022cs.LGcited by 8

Not on the map. Why?

Abstract (arXiv)

Federated learning (FL) trains a global model across a number of decentralized users, each with a local dataset. Compared to traditional centralized learning, FL does not require direct access to local datasets and thus aims to mitigate data privacy concerns. However, data privacy leakage in FL still exists due to inference attacks, including membership inference, property inference, and data inversion. In this work, we propose a new type of privacy inference attack, coined Preference Profiling Attack (PPA), that accurately profiles the private preferences of a local user, e.g., most liked (disliked) items from the client's online shopping and most common expressions from the user's selfies. In general, PPA can profile top-k (i.e., k = 1, 2, 3 and k = 1 in particular) preferences contingent on the local client (user)'s characteristics. Our key insight is that the gradient variation of a local user's model has a distinguishable sensitivity to the sample proportion of a given class, especially the majority (minority) class. By observing a user model's gradient sensitivity to a class, PPA can profile the sample proportion of the class in the user's local dataset, and thus the user's preference of the class is exposed. The inherent statistical heterogeneity of FL further facilitates PPA. We have extensively evaluated the PPA's effectiveness using four datasets (MNIST, CIFAR10, RAF-DB and Products-10K). Our results show that PPA achieves 90% and 98% top-1 attack accuracy to the MNIST and CIFAR10, respectively. More importantly, in real-world commercial scenarios of shopping (i.e., Products-10K) and social network (i.e., RAF-DB), PPA gains a top-1 attack accuracy of 78% in the former case to infer the most ordered items (i.e., as a commercial competitor), and 88% in the latter case to infer a victim user's most often facial expressions, e.g., disgusted.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 34 of its 78 references that are in the map. First posted on arXiv 10 Feb 2022.

Builds on

34 of 78 references.

References · 34

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2019Advances and Open Problems in Federated Learningcited by 3,021
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2020Extracting Training Data from Large Language Modelscited by 2,144
  6. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,531
  7. 2019On the Convergence of FedAvg on Non-IID Datacited by 1,220
  8. 2018Federated Learning with Non-IID Datacited by 1,099
  9. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  10. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  11. 2019Federated Machine Learning: Concept and Applicationscited by 409
  12. 2018Split learning for health: Distributed deep learning without sharing raw patient datacited by 391
22 more
  1. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
  2. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  3. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  4. 2020Three Approaches for Personalization with Applications to Federated Learningcited by 321
  5. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
  6. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  7. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  8. 2018Deep Learning in Mobile and Wireless Networking: A Surveycited by 117
  9. 2019Analyzing Information Leakage of Updates to Natural Language Modelscited by 89
  10. 2019Differentially Private Model Publishing for Deep Learningcited by 69
  11. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 63
  12. 2020Products-10K: A Large-scale Product Recognition Datasetcited by 42
  13. 2019The Value of Collaboration in Convex Machine Learning with Differential Privacycited by 24
  14. 2021Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learningcited by 21
  15. 2021Property Inference Attacks on Convolutional Neural Networks: Influence and Implications of Target Model's Complexitycited by 19
  16. 2021Efficient passive membership inference attack in federated learningcited by 14
  17. 2021Federated Learning over Wireless Networks: A Band-limited Coordinated Descent Approachcited by 11
  18. 2020CheckDP: An Automated and Integrated Approach for Proving Differential Privacy or Finding Precise Counterexamplescited by 7
  19. 2020A Novel Privacy-Preserved Recommender System Framework based on Federated Learningcited by 6
  20. 2021DPGen: Automated Program Synthesis for Differential Privacycited by 3
  21. 2017Relationship Profiling over Social Networks: Reverse Smoothness from Similarity to Closenesscited by 2
  22. 2021Towards Node Liability in Federated Learning: Computational Cost and Network Overheadcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 1; 2024: 2; 2025: 2; 2026: 2.

8 papers.

  1. 2022Binarizing Split Learning for Data Privacy Enhancement and Computation Reductioncited by 11
  2. 2023Vertical Federated Learning: Taxonomies, Threats, and Prospectscited by 8
  3. 2024Decaf: Data Distribution Decompose Attack against Federated Learningcited by 4
  4. 2024Contribution Evaluation of Heterogeneous Participants in Federated Learning via Prototypical Representationscited by 3
  5. 2025EC-LDA : Label Distribution Inference Attack against Federated Graph Learning with Embedding Compressioncited by 1
  6. 2025Setup Once, Secure Always: A Single-Setup Secure Federated Learning Aggregation Protocol with Forward and Backward Secrecy for Dynamic Userscited by 0
  7. 2026Fed-Listing: Federated Label Distribution Inference in Graph Neural Networkscited by 0
  8. 2026MPT: Missing Prototype Tracking via Barycentric Reconstruction in Vehicular Federated Learningcited by 0