Federated Membership Inference Attack

The attacker aims to infer the presence or absence of a specific data point in a client's local training set by observing the model's behavior.

• Target: A single patient's electronic health record (EHR) or medical image.
• Mechanism: Exploits differences in model confidence, loss values, or gradient updates between member and non-member data points.
• Threat Model: Typically assumes a passive, honest-but-curious adversary with access to model outputs or shared gradients.

The attack is executed by training a binary shadow classifier to distinguish between member and non-member data based on model outputs.

• Shadow Models: Multiple local models are trained on known datasets to mimic the target model's behavior.
• Feature Extraction: Prediction vectors, confidence scores, and loss values are used as input features for the attack model.
• Threshold Calibration: The attack model learns a decision boundary that maximizes inference accuracy on held-out data.

In a federated setting, the attack surface expands beyond centralized models to include gradient leakage and parameter updates.

• Gradient Inversion: Reconstructing training data from shared gradient updates during federated averaging.
• Update Sniffing: Observing the delta between global model parameters before and after a client's contribution.
• Passive Observation: Monitoring the global model's output distribution over successive communication rounds to infer membership.

Robust privacy guarantees are achieved by combining multiple defensive layers to degrade attack precision.

• Differential Privacy (DP): Adding calibrated Gaussian noise to gradients or model updates bounds the attacker's inference advantage, quantified by the privacy budget (ε).
• Secure Aggregation (SecAgg): Ensures the central server only sees the aggregated sum, not individual client updates.
• Knowledge Distillation: Training student models on public datasets using teacher model predictions avoids direct weight transfer.

Attack success is quantified using standard binary classification metrics, with a focus on the true positive rate at low false positive rates.

• Attack AUC: Area Under the Receiver Operating Characteristic curve for the membership classifier.
• TPR @ 0.1% FPR: The true positive rate when the false positive rate is fixed at a very low threshold, a stringent privacy standard.
• Privacy Loss (ε): The differential privacy parameter directly bounds the maximum achievable attack advantage.

Membership inference resistance is a key technical safeguard for demonstrating compliance with data minimization principles.

• HIPAA: Demonstrating that a model does not memorize individual patient records supports the Safe Harbor de-identification standard.
• GDPR: A successful attack constitutes a personal data breach if the training data is considered identifiable.
• Audit Trails: Federated membership inference tests should be logged as part of an Algorithmic Impact Assessment for regulatory review.

The primary mathematical defense against membership inference. DP provides a quantifiable guarantee (ε, δ) that the output of a federated model update reveals no information about any single patient's inclusion.

• Mechanism: Adds calibrated Gaussian or Laplacian noise to gradients before aggregation.
• Trade-off: Higher privacy (lower epsilon) degrades model utility; the privacy-utility trade-off must be carefully balanced.
• Audit Role: The membership inference attack success rate directly measures the effective privacy leakage, validating that the claimed epsilon guarantee holds empirically.

A related but distinct privacy attack where an adversary attempts to reconstruct representative features of the private training data from shared model updates.

• Difference from Membership Inference: Inversion aims to generate what the data looks like, while membership inference asks was this specific record present?
• Attack Vector: Exploits the gradient of the loss with respect to the input to iteratively synthesize a prototype of a target class.
• Defense: Strong DP and gradient clipping are effective mitigations against both attack families.

A cryptographic protocol that ensures the central server can only compute the sum of model updates without inspecting any individual client's contribution.

• Mechanism: Uses secret sharing and pairwise masking so that individual gradients are never revealed in plaintext.
• Impact on Audits: SecAgg prevents a passive observer from directly analyzing single-client updates, but membership inference can still be performed on the aggregated global model.
• Complementary Defense: Works in tandem with DP; SecAgg protects against the aggregator, DP protects against the final model.

A finite, quantifiable measure of the total privacy loss permitted over a series of federated training rounds. Each query or model release consumes a portion of this budget.

• Accounting: Advanced composition theorems (e.g., Rényi DP, zCDP) track cumulative privacy loss across thousands of rounds.
• Audit Integration: A membership inference attack at round t reveals the actual privacy leakage, which can be compared against the theoretical budget to detect overspending.
• Budget Exhaustion: Once the budget is depleted, no further model updates can be released without risking re-identification.

A privacy-preserving method for aggregating classification performance across institutions by securely summing true positive, false positive, true negative, and false negative counts.

• Relevance to Membership Inference: The attack's own performance is evaluated using a confusion matrix (TP = correctly identified member, FP = non-member flagged as member).
• Federated Computation: Enables auditing the attack's success rate across all silos without centralizing individual patient predictions.
• Metrics Derived: Precision, recall, and F1-score of the attack are computed directly from the federated confusion matrix.

The task of identifying inference-time inputs that differ fundamentally from the federated training distribution. This is a complementary safety mechanism to membership inference audits.

• Connection: A sample detected as OOD is, by definition, a non-member, but membership inference provides a more fine-grained signal for in-distribution samples.
• Techniques: Energy-based scores, Mahalanobis distance, and Monte Carlo Dropout uncertainty are adapted for federated computation.
• Clinical Relevance: Flagging OOD inputs prevents unreliable predictions on novel patient populations.