# Turning Privacy-preserving Mechanisms against Federated Learning

arXiv: https://arxiv.org/abs/2305.05355 · HTML: https://mlsanity.com/paper/2305.05355/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security.
- Builds on 21 of its 40 references that are in the map.
- First posted on arXiv 9 May 2023.

## Placed in

- LLM safety and security / [Federated unlearning and poisoning](https://mlsanity.com/safety/federated-unlearning-and-poisoning/)

## Builds on (most cited first, 21 of 21)

- [Graph Convolutional Neural Networks for Web-Scale Recommender Systems](https://mlsanity.com/paper/1806.01973/) (2018)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Graph Neural Networks for Social Recommendation](https://mlsanity.com/paper/1902.07243/) (2019)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Graph Neural Networks in Recommender Systems: A Survey](https://mlsanity.com/paper/2011.02260/) (2020)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning](https://mlsanity.com/paper/1702.07464/) (2017)
- [A Little Is Enough: Circumventing Defenses For Distributed Learning](https://mlsanity.com/paper/1902.06156/) (2019)
- [Threats to Federated Learning: A Survey](https://mlsanity.com/paper/2003.02133/) (2020)
- [Secure Federated Matrix Factorization](https://mlsanity.com/paper/1906.05108/) (2019)
- [Quantifying Privacy Leakage in Graph Embedding](https://mlsanity.com/paper/2010.00906/) (2020)
- [A Neural Influence Diffusion Model for Social Recommendation](https://mlsanity.com/paper/1904.10322/) (2019)
- [Locally Private Graph Neural Networks](https://mlsanity.com/paper/2006.05535/) (2020)
- [Influence Function based Data Poisoning Attacks to Top-N Recommender Systems](https://mlsanity.com/paper/2002.08025/) (2020)
- [Poisoning Attacks to Graph-Based Recommender Systems](https://mlsanity.com/paper/1809.04127/) (2018)
- [Federated Social Recommendation with Graph Neural Network](https://mlsanity.com/paper/2111.10778/) (2021)
- [PipAttack: Poisoning Federated Recommender Systems forManipulating Item Promotion](https://mlsanity.com/paper/2110.10926/) (2021)
- [FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Sampling](https://mlsanity.com/paper/2202.04975/) (2022)
- [Group Property Inference Attacks Against Graph Neural Networks](https://mlsanity.com/paper/2209.01100/) (2022)
- [Exploiting Cross-Session Information for Session-based Recommendation with Graph Neural Networks](https://mlsanity.com/paper/2107.00852/) (2021)
- [Link-Backdoor: Backdoor Attack on Link Prediction via Node Injection](https://mlsanity.com/paper/2208.06776/) (2022)

## Built on by (most cited first, 8 of 8)

- [A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspective](https://mlsanity.com/paper/2311.16065/) (2023)
- [Enhancing Object Detection with Hybrid dataset in Manufacturing Environments: Comparing Federated Learning to Conventional Techniques](https://mlsanity.com/paper/2408.08974/) (2024)
- [Contribution Evaluation of Heterogeneous Participants in Federated Learning via Prototypical Representations](https://mlsanity.com/paper/2407.02073/) (2024)
- [XBreaking: Understanding how LLMs security alignment can be broken](https://mlsanity.com/paper/2504.21700/) (2025)
- [KDk: A Defense Mechanism Against Label Inference Attacks in Vertical Federated Learning](https://mlsanity.com/paper/2404.12369/) (2024)
- [Let's Focus: Focused Backdoor Attack against Federated Transfer Learning](https://mlsanity.com/paper/2404.19420/) (2024)
- [Secure Federated Data Distillation](https://mlsanity.com/paper/2502.13728/) (2025)
- [Privacy Preserving and Robust Aggregation for Cross-Silo Federated Learning in Non-IID Settings](https://mlsanity.com/paper/2503.04451/) (2025)

## Abstract (arXiv)

Recently, researchers have successfully employed Graph Neural Networks (GNNs) to build enhanced recommender systems due to their capability to learn patterns from the interaction between involved entities. In addition, previous studies have investigated federated learning as the main solution to enable a native privacy-preserving mechanism for the construction of global GNN models without collecting sensitive data into a single computation unit. Still, privacy issues may arise as the analysis of local model updates produced by the federated clients can return information related to sensitive local data. For this reason, experts proposed solutions that combine federated learning with Differential Privacy strategies and community-driven approaches, which involve combining data from neighbor clients to make the individual local updates less dependent on local sensitive data. In this paper, we identify a crucial security flaw in such a configuration, and we design an attack capable of deceiving state-of-the-art defenses for federated learning. The proposed attack includes two operating modes, the first one focusing on convergence inhibition (Adversarial Mode), and the second one aiming at building a deceptive rating injection on the global federated model (Backdoor Mode). The experimental results show the effectiveness of our attack in both its modes, returning on average 60% performance detriment in all the tests on Adversarial Mode and fully effective backdoors in 93% of cases for the tests performed on Backdoor Mode.