mlsanityData to 7 Oct 2026

Secure Aggregation is Not Private Against Membership Inference Attacks

arXiv 2403.17775 ↗First posted 26 Mar 2024cs.LG cs.CRcited by 5

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

Secure aggregation (SecAgg) is a commonly-used privacy-enhancing mechanism in federated learning, affording the server access only to the aggregate of model updates while safeguarding the confidentiality of individual updates. Despite widespread claims regarding SecAgg's privacy-preserving capabilities, a formal analysis of its privacy is lacking, making such presumptions unjustified. In this paper, we delve into the privacy implications of SecAgg by treating it as a local differential privacy (LDP) mechanism for each local update. We design a simple attack wherein an adversarial server seeks to discern which update vector a client submitted, out of two possible ones, in a single training round of federated learning under SecAgg. By conducting privacy auditing, we assess the success probability of this attack and quantify the LDP guarantees provided by SecAgg. Our numerical results unveil that, contrary to prevailing claims, SecAgg offers weak privacy against membership inference attacks even in a single training round. Indeed, it is difficult to hide a local update by adding other independent local updates when the updates are of high dimension. Our findings underscore the imperative for additional privacy-enhancing mechanisms, such as noise injection, in federated learning.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 17 of its 33 references that are in the map. First posted on arXiv 26 Mar 2024.

Builds on

17 of 33 references.

References · 17

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  3. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  4. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 216
  5. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  6. 2018cpSGD: Communication-efficient and differentially-private distributed SGDcited by 157
  7. 2021The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregationcited by 127
  8. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  9. 2021Optimal Accounting of Differential Privacy via Characteristic Functioncited by 83
  10. 2022Do Gradient Inversion Attacks Make Federated Learning Unsafe?cited by 44
  11. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  12. 2021Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learningcited by 38
5 more
  1. 2022How Much Privacy Does Federated Learning with Secure Aggregation Guarantee?cited by 19
  2. 2023Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregationcited by 16
  3. 2023Randomized Quantization is All You Need for Differential Privacy in Federated Learningcited by 16
  4. 2023Client-specific Property Inference against Secure Aggregation in Federated Learningcited by 9
  5. 2023Private Federated Learning with Autotuned Compressioncited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 4; 2026: 1.

5 papers.

  1. 2025Subgraph Federated Learning via Spectral Methodscited by 6
  2. 2025Private Aggregation for Byzantine-Resilient Heterogeneous Federated Learningcited by 0
  3. 2025Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Modelscited by 0
  4. 2025Beyond Trade-offs: A Unified Framework for Privacy, Robustness, and Communication Efficiency in Federated Learningcited by 0
  5. 2026Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learningcited by 0