mlsanityData to 7 Oct 2026

Active Membership Inference Attack under Local Differential Privacy in Federated Learning

arXiv 2302.12685 ↗First posted 24 Feb 2023cs.LG cs.AI cs.CRcited by 17

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

Federated learning (FL) was originally regarded as a framework for collaborative learning among clients with data privacy protection through a coordinating server. In this paper, we propose a new active membership inference (AMI) attack carried out by a dishonest server in FL. In AMI attacks, the server crafts and embeds malicious parameters into global models to effectively infer whether a target data sample is included in a client's private training data or not. By exploiting the correlation among data features through a non-linear decision boundary, AMI attacks with a certified guarantee of success can achieve severely high success rates under rigorous local differential privacy (LDP) protection; thereby exposing clients' training data to significant privacy risk. Theoretical and experimental results on several benchmark datasets show that adding sufficient privacy-preserving noise to prevent our attack would significantly damage FL's model utility.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 26 of its 42 references that are in the map. First posted on arXiv 24 Feb 2023.

Builds on

26 of 42 references.

References · 26

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2019Deep Leakage from Gradientscited by 1,004
  6. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  7. 2021Membership Inference Attacks From First Principlescited by 839
  8. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  9. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  10. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  11. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  12. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
14 more
  1. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  2. 2014RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Responsecited by 262
  3. 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 233
  4. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  5. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  6. 2020Local Differential Privacy based Federated Learning for Internet of Thingscited by 74
  7. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 63
  8. 2020LDP-FL: Practical Private Aggregation in Federated Learning with Local Differential Privacycited by 63
  9. 2019Collecting and Analyzing Multidimensional Data with Local Differential Privacycited by 46
  10. 2019Local Differential Privacy for Deep Learningcited by 46
  11. 2020Towards Differentially Private Text Representationscited by 28
  12. 2022Preserving Privacy and Security in Federated Learningcited by 13
  13. 2022Blockchain-based Secure Client Selection in Federated Learningcited by 5
  14. 2020DP-Cryptography: Marrying Differential Privacy and Cryptography in Emerging Applicationscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 6; 2025: 5; 2026: 3.

17 papers.

Sort:

By area:

  1. 2023Gradient-Free Privacy Leakage in Federated Language Models through Selective Weight Tamperingcited by 9
  2. 2024Analysis of Privacy Leakage in Federated Large Language Modelscited by 9
  3. 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5
  4. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  5. 2025DP-FedLoRA: Privacy-Enhanced Federated Fine-Tuning for On-Device Large Language Modelscited by 4
  6. 2024Memory Backdoor Attacks on Neural Networkscited by 3
  7. 2025Gradient Inversion Attacks on Parameter-Efficient Fine-Tuningcited by 3
  8. 2024Privacy Threats and Countermeasures in Federated Learning for Internet of Things: A Systematic Reviewcited by 2
  9. 2023Membership Inference Attacks on DNNs using Adversarial Perturbationscited by 1
  10. 2024Attribute Inference Attacks for Federated Regression Taskscited by 1
  11. 2024BGTplanner: Maximizing Training Accuracy for Differentially Private Federated Recommenders via Strategic Privacy Budget Allocationcited by 1
  12. 2025Securing Genomic Data Against Inference Attacks in Federated Learning Environmentscited by 1
5 more
  1. 2026Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuningcited by 1
  2. 2026Loss Landscape Poisoning: Targeted Extraction of Unseen Training Data from LLMscited by 1
  3. 2023OASIS: Offsetting Active Reconstruction Attacks in Federated Learningcited by 0
  4. 2025Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Modelscited by 0
  5. 2026Res-MIA: A Training-Free Resolution-Based Membership Inference Attack on Federated Learning Modelscited by 0