Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks
Not on the map. Why?
Abstract (arXiv)
As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with near-perfect accuracy (approximately 1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacy-utility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (sigma in {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C=1.0), and report formal (epsilon, delta)-DP budgets through Renyi accounting. A practical region (sigma in [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA-256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 11 of its 26 references that are in the map. First posted on arXiv 2 Sep 2026.
Builds on
11 of 26 references.
References · 11
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2016Deep Learning with Differential Privacycited by 2,728
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
- 2019Deep Leakage from Gradientscited by 1,021
- 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
- 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 571
- 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 459
- 2019Robust and Communication-Efficient Federated Learning from Non-IID Datacited by 419
- 2019The Non-IID Data Quagmire of Decentralized Machine Learningcited by 305
- 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
- 2020Privacy and Robustness in Federated Learning: Attacks and Defensescited by 166
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Targeted Attacks and Defenses for Distributed Federated Learning in Vehicular Networks
- 2024Private Data Leakage in Federated Human Activity Recognition for Wearable Healthcare Devices ↗
- 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
- 2025Distributed Federated Learning for Vehicular Network Security: Anomaly Detection Benefits and Multi-Domain Attack Threats
- 2026Client-Verifiable and Efficient Federated Unlearning in Low-Altitude Wireless Networks
- 2026Leveraging Membership Inference Attacks for Privacy Measurement in Federated Learning for Remote Sensing Images
- 2024Model Partition and Resource Allocation for Split Learning in Vehicular Edge Networks
- 2025Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models