Federated Learning (FL) enables collaborative model training while keeping training data localized, allowing us to preserve privacy in various domains including remote sensing. However, recent studies show that FL models may still leak sensitive information through their outputs, motivating the need for rigorous privacy evaluation. In this paper, we leverage membership inference attacks (MIA) as a quantitative privacy measurement framework for FL applied to remote sensing image classification. We evaluate multiple black-box MIA techniques, including entropy-based attacks, modified entropy attacks, and the likelihood ratio attack, across different FL algorithms and communication strategies. Experiments conducted on two public scene classification datasets demonstrate that MIA effectively reveals privacy leakage not captured by accuracy alone. Our results show that communication-efficient FL strategies reduce MIA success rates while maintaining competitive performance. These findings confirm MIA as a practical metric and highlight the importance of integrating privacy measurement into FL system design for remote sensing applications.
Perfectly Accurate Membership Inference by a Dishonest Central Server in Federated Learning
Technische Universität Wien（维也纳技术大学）；CSC-CONICET（阿根廷国家科学技术研究委员会）；Universidad de Buenos Aires（布宜诺斯艾利斯大学）；MILA - Quebec AI Institute（魁北克人工智能研究所）；CNRS（法国国家科学研究中心）；CentraleSupélec（中央高等电力学院）
In cross-device federated learning (FL) setting, clients such as mobiles cooperate with the server to train a global machine learning model, while maintaining their data locally. However, recent work shows that client's private information can still be disclosed to an adversary who just eavesdrops the messages exchanged between the client and the server. For example, the adversary can infer whether the client owns a specific data instance, which is called a passive membership inference attack. In this paper, we propose a new passive inference attack that requires much less computation power an…
Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning
CISE, University of Florida, FL, USA（佛罗里达大学计算机与信息科学系）；North Carolina State University, NC, USA（北卡罗来纳州立大学）；Washington State University, WA, USA（华盛顿州立大学）；Seoul National University of Science and Technology, South Korea（韩国科学技术大学）
University College London（伦敦大学学院）；DeepMind（深度思维）；Alan Turing Institute（艾伦·图灵研究所）
Federated Learning (FL) allows multiple participants to train machine learning models collaboratively by keeping their datasets local while only exchanging model updates. Alas, this is not necessarily free from privacy and robustness vulnerabilities, e.g., via membership, property, and backdoor attacks. This paper investigates whether and to what extent one can use differential Privacy (DP) to protect both privacy and robustness in FL. To this end, we present a first-of-its-kind evaluation of Local and Central Differential Privacy (LDP/CDP) techniques in FL, assessing their feasibility and eff…
Free Lunch for Federated Remote Sensing Target Fine-Grained Classification: A Parameter-Efficient Framework
Guangdong-Hongkong-Macao Greater Bay Area Weather Research Center for Monitoring Warning and Forecasting (Shenzhen Institute of Meteorological Innovation)（粤港澳大湾区气象监测预警预报中心（深圳气象创新研究院））；Australian Artificial Intelligence Institute, FEIT, University of Technology Sydney（悉尼科技大学工程与信息技术学院澳大利亚人工智能研究所）；School of Electrical and Electronic Engineering, Nanyang Technological University（南洋理工大学电气与电子工程学院）；School of Information and Communication Engineering, Hainan University（海南大学信息与通信工程学院）；School of Computer, Electronics and Information, Guangxi University（广西大学计算机与电子信息学院）
University of Edinburgh（爱丁堡大学）；Princeton University（普林斯顿大学）；University of Southern California（南加州大学）
As in traditional machine learning models, models trained with federated learning may exhibit disparate performance across demographic groups. Model holders must identify these disparities to mitigate undue harm to the groups. However, measuring a model's performance in a group requires access to information about group membership which, for privacy reasons, often has limited availability. We propose novel locally differentially private mechanisms to measure differences in performance across groups while protecting the privacy of group membership. To analyze the effectiveness of the mechanisms…
Huawei Munich Research Center（华为慕尼黑研究中心）；TU Dresden（德累斯顿工业大学）
Federated Learning (FL) is an emerging machine learning paradigm that enables multiple clients to jointly train a model to take benefits from diverse datasets from the clients without sharing their local training datasets. FL helps reduce data privacy risks. Unfortunately, FL still exist several issues regarding privacy and security. First, it is possible to leak sensitive information from the shared training parameters. Second, malicious clients can collude with each other to steal data, models from regular clients or corrupt the global training model. To tackle these challenges, we propose S…
University of Massachusetts Amherst（马萨诸塞大学阿默斯特分校）；National University of Singapore（新加坡国立大学）
Deep neural networks are susceptible to various inference attacks as they remember information about their training data. We design white-box inference attacks to perform a comprehensive privacy analysis of deep learning models. We measure the privacy leakage through parameters of fully trained models as well as the parameter updates of models during training. We design inference algorithms for both centralized and federated learning, with respect to passive and active inference attackers, and assuming different adversary prior knowledge. We evaluate our novel white-box membership inference at…
Heilongjiang University（黑龙江大学）；Nanyang Technological University（南洋理工大学）；Prince Sattam Bin Abdulaziz University（萨塔姆·本·阿卜杜勒阿齐兹亲王大学）；Tokyo Institute of Technology（东京工业大学）；Changchun University of Science and Technology（长春理工大学）；Menoufia University（梅努菲亚大学）；Nile University（尼罗河大学）
Federated Learning (FL) has been recently proposed as an emerging paradigm to build machine learning models using distributed training datasets that are locally stored and maintained on different devices in 5G networks while providing privacy preservation for participants. In FL, the central aggregator accumulates local updates uploaded by participants to update a global model. However, there are two critical security threats: poisoning and membership inference attacks. These attacks may be carried out by malicious or unreliable participants, resulting in the construction failure of global mod…
Mississippi State University（密西西比州立大学）；University of South Florida（南佛罗里达大学）；University of Oklahoma（俄克拉荷马大学）
Federated learning (FL) provides a high efficient decentralized machine learning framework, where the training data remains distributed at remote clients in a network. Though FL enables a privacy-preserving mobile edge computing framework using IoT devices, recent studies have shown that this approach is susceptible to poisoning attacks from the side of remote clients. To address the poisoning attacks on FL, we provide a \textit{two-phase} defense algorithm called {Lo}cal {Ma}licious Facto{r} (LoMar). In phase I, LoMar scores model updates from each remote client by measuring the relative dist…
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Peng Cheng Laboratory（鹏城实验室）；School of Computer and Information Engineering, Zhejiang Gongshang University（浙江工商大学计算机与信息工程学院）；Information Security and National Computing Grid Laboratory, Southwest Jiaotong University（西南交通大学）
Although federated learning improves privacy of training data by exchanging local gradients or parameters rather than raw data, the adversary still can leverage local gradients and parameters to obtain local training data by launching reconstruction and membership inference attacks. To defend such privacy attacks, many noises perturbation methods (like differential privacy or CountSketch matrix) have been widely designed. However, the strong defence ability and high learning accuracy of these schemes cannot be ensured at the same time, which will impede the wide application of FL in practice (…
Utah State University（犹他州立大学）；University of Wisconsin-Whitewater（威斯康星大学怀特沃特分校）；University of Nebraska–Lincoln（内布拉斯加大学林肯分校）
Motivated by the ever-increasing concerns on personal data privacy and the rapidly growing data volume at local clients, federated learning (FL) has emerged as a new machine learning setting. An FL system is comprised of a central parameter server and multiple local clients. It keeps data at local clients and learns a centralized model by sharing the model parameters learned locally. No local data needs to be shared, and privacy can be well protected. Nevertheless, since it is the model instead of the raw data that is shared, the system can be exposed to the poisoning model attacks launched by…
Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models
Department of CISE, University of Florida, USA.（佛罗里达大学计算机与信息科学系）；Center for Nonlinear Studies, Los Alamos National Lab, USA（洛斯阿拉莫斯国家实验室非线性研究中心）；Computational Science Center, National Renewable Energy Laboratory, USA（国家可再生能源实验室计算科学中心）
University of Southern California（南加州大学）；University of California, Irvine（加州大学欧文分校）；New Jersey Institute of Technology（新泽西理工学院）；FedML Inc.（FedML公司）
Federated analytics (FA) is a privacy-preserving framework for computing data analytics over multiple remote parties (e.g., mobile devices) or silo-ed institutional entities (e.g., hospitals, banks) without sharing the data among parties. Motivated by the practical use cases of federated analytics, we follow a systematic discussion on federated analytics in this article. In particular, we discuss the unique characteristics of federated analytics and how it differs from federated learning. We also explore a wide range of FA queries and discuss various existing solutions and potential use case a…
University of Auckland（奥克兰大学）；Lehigh University（利哈伊大学）；Macquarie University（麦考瑞大学）
Federated learning (FL) has emerged as a promising privacy-aware paradigm that allows multiple clients to jointly train a model without sharing their private data. Recently, many studies have shown that FL is vulnerable to membership inference attacks (MIAs) that can distinguish the training members of the given model from the non-members. However, existing MIAs ignore the source of a training member, i.e., the information of which client owns the training member, while it is essential to explore source privacy in FL beyond membership privacy of examples from all clients. The leakage of source…
Information Sciences Institute, University of Southern California（南加州大学信息科学研究所）；Stevens Neuroimaging and Informatics Institute, University of Southern California（南加州大学史蒂文斯神经影像与信息学研究所）
Federated training of large deep neural networks can often be restrictive due to the increasing costs of communicating the updates with increasing model sizes. Various model pruning techniques have been designed in centralized settings to reduce inference times. Combining centralized pruning techniques with federated training seems intuitive for reducing communication costs -- by pruning the model parameters right before the communication step. Moreover, such a progressive model pruning approach during training can also reduce training times/costs. To this end, we propose FedSparsify, which pe…
Client-specific Property Inference against Secure Aggregation in Federated Learning
CISPA Helmholtz Center for Information Security（CISPA赫尔姆霍茨信息安全中心）；Department of Networked Systems and Services, CrySyS Lab, BME（布达佩斯经济技术大学网络系统与服务系CrySyS实验室）
Imperial College London（帝国理工学院）；Telefónica Research（西班牙电信研究院）
We propose and implement a Privacy-preserving Federated Learning ($PPFL$) framework for mobile systems to limit privacy leakages in federated learning. Leveraging the widespread presence of Trusted Execution Environments (TEEs) in high-end and mobile devices, we utilize TEEs on clients for local training, and on servers for secure aggregation, so that model/gradient updates are hidden from adversaries. Challenged by the limited memory size of current TEEs, we leverage greedy layer-wise training to train each model's layer inside the trusted area until its convergence. The performance evaluatio…
Advanced adversarial attacks such as membership inference and model memorization can make federated learning (FL) vulnerable and potentially leak sensitive private data. Local differentially private (LDP) approaches are gaining more popularity due to stronger privacy notions and native support for data distribution compared to other differentially private (DP) solutions. However, DP approaches assume that the FL server (that aggregates the models) is honest (run the FL protocol honestly) or semi-honest (run the FL protocol honestly while also trying to learn as much information as possible). T…
Using Decentralized Aggregation for Federated Learning with Differential Privacy
College of Computing and Information Technology, Arab Academy for Science, Technology, and Maritime Transport (AASTMT)（阿拉伯科学、技术与海运学院（AASTMT）计算与信息技术学院）；Universidade de Vigo（维戈大学）
Information Sciences Institute, University of Southern California（南加州大学信息科学研究所）；Mark and Mary Stevens Institute for Neuroimaging and Informatics, Keck School of Medicine, University of Southern California（南加州大学凯克医学院马克与玛丽·史蒂文斯神经影像与信息学研究所）；University of Southern California（南加州大学）
Ensuring the privacy of research participants is vital, even more so in healthcare environments. Deep learning approaches to neuroimaging require large datasets, and this often necessitates sharing data between multiple sites, which is antithetical to the privacy objectives. Federated learning is a commonly proposed solution to this problem. It circumvents the need for data sharing by sharing parameters during the training process. However, we demonstrate that allowing access to parameters may leak private information even if data is never directly shared. In particular, we show that it is pos…
