# Active Membership Inference Attack under Local Differential Privacy in Federated Learning

arXiv: https://arxiv.org/abs/2302.12685 · HTML: https://mlsanity.com/paper/2302.12685/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security.
- Builds on 26 of its 42 references that are in the map.
- First posted on arXiv 24 Feb 2023.

## Placed in

- LLM safety and security / [Federated unlearning and poisoning](https://mlsanity.com/safety/federated-unlearning-and-poisoning/)

## Builds on (most cited first, 26 of 26)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks](https://mlsanity.com/paper/1802.08232/) (2018)
- [Inverting Gradients -- How easy is it to break privacy in federated learning?](https://mlsanity.com/paper/2003.14053/) (2020)
- [Exploiting Unintended Feature Leakage in Collaborative Learning](https://mlsanity.com/paper/1805.04049/) (2018)
- [ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models](https://mlsanity.com/paper/1806.01246/) (2018)
- [Certified Robustness to Adversarial Examples with Differential Privacy](https://mlsanity.com/paper/1802.03471/) (2018)
- [See through Gradients: Image Batch Recovery via GradInversion](https://mlsanity.com/paper/2104.07586/) (2021)
- [Systematic Evaluation of Privacy Risks of Machine Learning Models](https://mlsanity.com/paper/2003.10595/) (2020)
- [RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response](https://mlsanity.com/paper/1407.6981/) (2014)
- [Differentially Private Learning Needs Better Features (or Much More Data)](https://mlsanity.com/paper/2011.11660/) (2020)
- [When the Curious Abandon Honesty: Federated Learning Is Not Private](https://mlsanity.com/paper/2112.02918/) (2021)
- [Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Models](https://mlsanity.com/paper/2110.13057/) (2021)
- [Local Differential Privacy based Federated Learning for Internet of Things](https://mlsanity.com/paper/2004.08856/) (2020)
- [Knock Knock, Who's There? Membership Inference on Aggregate Location Data](https://mlsanity.com/paper/1708.06145/) (2017)
- [LDP-FL: Practical Private Aggregation in Federated Learning with Local Differential Privacy](https://mlsanity.com/paper/2007.15789/) (2020)
- [Collecting and Analyzing Multidimensional Data with Local Differential Privacy](https://mlsanity.com/paper/1907.00782/) (2019)
- [Local Differential Privacy for Deep Learning](https://mlsanity.com/paper/1908.02997/) (2019)
- [Towards Differentially Private Text Representations](https://mlsanity.com/paper/2006.14170/) (2020)
- [Preserving Privacy and Security in Federated Learning](https://mlsanity.com/paper/2202.03402/) (2022)
- [Blockchain-based Secure Client Selection in Federated Learning](https://mlsanity.com/paper/2205.05611/) (2022)
- [DP-Cryptography: Marrying Differential Privacy and Cryptography in Emerging Applications](https://mlsanity.com/paper/2004.08887/) (2020)

## Built on by (most cited first, 17 of 17)

- [Gradient-Free Privacy Leakage in Federated Language Models through Selective Weight Tampering](https://mlsanity.com/paper/2310.16152/) (2023)
- [Analysis of Privacy Leakage in Federated Large Language Models](https://mlsanity.com/paper/2403.04784/) (2024)
- [Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learning](https://mlsanity.com/paper/2410.11205/) (2024)
- [Energy-Latency Attacks: A New Adversarial Threat to Deep Learning](https://mlsanity.com/paper/2503.04963/) (2025)
- [DP-FedLoRA: Privacy-Enhanced Federated Fine-Tuning for On-Device Large Language Models](https://mlsanity.com/paper/2509.09097/) (2025)
- [Memory Backdoor Attacks on Neural Networks](https://mlsanity.com/paper/2411.14516/) (2024)
- [Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning](https://mlsanity.com/paper/2506.04453/) (2025)
- [Privacy Threats and Countermeasures in Federated Learning for Internet of Things: A Systematic Review](https://mlsanity.com/paper/2407.18096/) (2024)
- [Membership Inference Attacks on DNNs using Adversarial Perturbations](https://mlsanity.com/paper/2307.05193/) (2023)
- [Attribute Inference Attacks for Federated Regression Tasks](https://mlsanity.com/paper/2411.12697/) (2024)
- [BGTplanner: Maximizing Training Accuracy for Differentially Private Federated Recommenders via Strategic Privacy Budget Allocation](https://mlsanity.com/paper/2412.02934/) (2024)
- [Securing Genomic Data Against Inference Attacks in Federated Learning Environments](https://mlsanity.com/paper/2505.07188/) (2025)
- [Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning](https://mlsanity.com/paper/2601.06641/) (2026)
- [Loss Landscape Poisoning: Targeted Extraction of Unseen Training Data from LLMs](https://mlsanity.com/paper/2606.17110/) (2026)
- [OASIS: Offsetting Active Reconstruction Attacks in Federated Learning](https://mlsanity.com/paper/2311.13739/) (2023)
- [Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models](https://mlsanity.com/paper/2506.17292/) (2025)
- [Res-MIA: A Training-Free Resolution-Based Membership Inference Attack on Federated Learning Models](https://mlsanity.com/paper/2601.17378/) (2026)

## Abstract (arXiv)

Federated learning (FL) was originally regarded as a framework for collaborative learning among clients with data privacy protection through a coordinating server. In this paper, we propose a new active membership inference (AMI) attack carried out by a dishonest server in FL. In AMI attacks, the server crafts and embeds malicious parameters into global models to effectively infer whether a target data sample is included in a client's private training data or not. By exploiting the correlation among data features through a non-linear decision boundary, AMI attacks with a certified guarantee of success can achieve severely high success rates under rigorous local differential privacy (LDP) protection; thereby exposing clients' training data to significant privacy risk. Theoretical and experimental results on several benchmark datasets show that adding sufficient privacy-preserving noise to prevent our attack would significantly damage FL's model utility.