GAN Enhanced Membership Inference: A Passive Local Attack in Federated Learning
Abstract
Federated learning has lately received great attention for its privacy protection feature. However, recent researches found that federated learning models are susceptible to various inference attacks. In this paper, we point out a membership inference attack method that can cause a serious privacy leakage in federated learning. An adversary who is a participant in federated learning can train a classification attack model to launch the membership inference attack, which determines if a data record is in the model's training dataset. The existing membership inference method is dissatisfied due to a lack of attack data since the training data of each participant are independent. To overcome the lack of attack data, an adversary can enrich attack data using the generative adversarial network (GAN), which is a practical method to increase data diversity. We substantiate that this GAN enhanced membership inference attack method has a 98% attack accuracy. We perform experiments to show that data diversity and the overfitting make federated learning models susceptible.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The fake parameter update from an adversary is a security bottleneck [81] which can impersonate a certain client and broadcast fake parameters.
“The fake parameter update from an adversary is also a security bottleneck [81] which can impersonate a certain client and broadcast fake parameters.”
From Federated learning meets blockchain in edge computing: Opportunities and challenges (2021) · cites this paper as [81]
Cites
Labaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,100 · see citing works
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Conditional Generative Adversarial Nets
Mirza, M., & Osindero, S. (2014) · arXiv · doi:10.48550/arxiv.1411.1784 · Cited by 8,863 · see citing works
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377 · see citing works
Blockchain and Federated Learning for Privacy-Preserved Data Sharing in Industrial IoT
Lu, Y., Huang, X., Dai, Y., Maharjan, S., & Zhang, Y. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2942190 · Cited by 1,245 · see citing works
Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning
Wang, Z., Song, M., Zhang, Z., Song, Y., Wang, Q., & Qi, H. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737416 · Cited by 881 · see citing works
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852 · see citing works
Verifynet: Secure and verifiable federated learning
Xu, G., Li, H., Liu, S., Yang, K., & Lin, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2929409 · Cited by 839 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703 · see citing works
Machine Learning Models that Remember Too Much
Song, C., Ristenpart, T., & Shmatikov, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134077 · Cited by 526 · see citing works
LOGAN: Membership Inference Attacks Against Generative Models
Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0008 · Cited by 433 · see citing works
Lu, Y., Huang, X., Dai, Y., Maharjan, S., & Zhang, Y. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2942179 · Cited by 387 · see citing works
Mitigating Sybils in Federated Learning Poisoning
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1808.04866 · Cited by 385 · see citing works
Multi-Objective Evolutionary Federated Learning
Zhu, H., & Jin, Y. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2019.2919699 · Cited by 304 · see citing works
Deep Learning towards Mobile Applications
Wang, J., Cao, B., Yu, P. S., Sun, L., Bao, W., & Zhu, X. (2018) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2018.00139 · Cited by 115 · see citing works
Anthropomorphism and AI: Turingʼs much misunderstood imitation game
Proudfoot, D. (2011) · Artificial Intelligence · doi:10.1016/j.artint.2011.01.006 · Cited by 109 · cited 1× · see citing works
“According to different objects, attacks can be divided into attack towards confidentiality, integrity, and availability [9].”
BackgroundNasr, M., Shokri, R., & Houmansadr, A. (2018) · arXiv (Cornell University) · Cited by 104 · see citing works
Federated Online Learning to Rank with Evolution Strategies
Kharitonov, E. (2019) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/3289600.3290968 · Cited by 38 · see citing works
GAN-DP: Generative Adversarial Net Driven Differentially Privacy-Preserving Big Data Publishing
Qu, Y., Yu, S., Zhang, J., Bình, H. T. T., Gao, L., & Zhou, W. (2019) · International Conference on Communications · doi:10.1109/icc.2019.8761070 · Cited by 28 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Federated learning meets blockchain in edge computing: Opportunities and challenges
Nguyen, D. C., Ding, M., Pham, Q.-V., Pathirana, P. N., Le, L. B., Seneviratne, A., Li, J., Niyato, D., & Poor, H. V. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3072611 · Cited by 661 · see citing works
Membership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 586 · see citing works
“• Attack F1-score [162] ([65, 76, 134, 164, 215, 237, 239]) Attack F1-score is the harmonic mean of Attack Precision and Attack Recall:”
BackgroundDistributed Artificial Intelligence Empowered by End-Edge-Cloud Computing: A Survey
Duan, S., Wang, D., Ren, J., Lyu, F., Zhang, Y., Wu, H., & Shen, X. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3218527 · Cited by 419 · see citing works
“Considering the lack of target training data in practice, Zhang et al. [227] used GAN to generate samples that have the same distribution as the original data records to fill the gap in attack data.”
MethodBlockchain-Based Federated Learning for Securing Internet of Things: A Comprehensive Survey
Issa, W., Moustafa, N., Turnbull, B., Sohrabi, N., & Tari, Z. (2022) · ACM Computing Surveys · doi:10.1145/3560816 · Cited by 338 · see citing works
“[174] proposed a passive membership attack that malicious participants in FL can perform.”
BackgroundRodríguez-Barroso, N., Jiménez-López, D., Luzón, M. V., Herrera, F., & Martínez-Cámara, E. (2023) · Information Fusion · doi:10.1016/j.inffus.2022.09.011 · Cited by 296 · see citing works
“[75] is a great example of using a GAN architecture for data augmentation to boost the effectiveness of the passive attacker with client-side knowledge from Nasr et al.”
MethodA Privacy-Aware and Incremental Defense Method Against GAN-Based Poisoning Attack
Qiao, F., Li, Z., & Kong, Y. (2023) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2023.3263241 · Cited by 222 · see citing works
“Thus, adversaries can utilize GAN to generate fake data close to the distribution of other participants’ data, which can become training datasets for other attacks of privacy leak, such as the membership inference attack [18], [19].”
BackgroundThe Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 191 · see citing works
Membership Inference Attacks and Defenses in Federated Learning: A Survey
Bai, L., Hu, H., Ye, Q., Li, H., Wang, L., & Xu, J. (2024) · ACM Computing Surveys · doi:10.1145/3704633 · Cited by 156 · see citing works
“From the perspective of the central server, this is intuitively equivalent to using record-level MIAs to sequentially infer the membership status of each local model [27, 61].”
InfluentialAn overview of implementing security and privacy in federated learning
Hu, K., Gong, S., Zhang, Q., Seng, C., Xia, M., & Jiang, S. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10846-8 · Cited by 162 · see citing works
Aziz, R., Banerjee, S., Bouzefrane, S., & Vinh, T. L. (2023) · Future Internet · doi:10.3390/fi15090310 · Cited by 141 · see citing works
Privacy and Fairness in Federated Learning: On the Perspective of Tradeoff
Chen, H., Zhu, T., Zhang, T., Zhou, W., & Yu, P. S. (2023) · ACM Computing Surveys · doi:10.1145/3606017 · Cited by 109 · see citing works
“set [75, 220] or, even worse, reconstruct the training data [59].”
BackgroundMohammadi, S., Balador, A., Sinaei, S., & Flammini, F. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104918 · Cited by 88 · see citing works
Federated Domain Generalization: A Survey
Li, Y., Wang, X., Zeng, R., Donta, P. K., Murturi, I., Huang, M., & Dustdar, S. (2025) · Proceedings of the IEEE · doi:10.1109/jproc.2025.3596173 · Cited by 74 · see citing works
“Zhang et al. [79] leveraged GANs to generate synthetic data with the same underlying distribution as the original dataset, guided by the target FL model’s discriminator, thereby enriching the training dataset and improving the imitative capability of the generated images.”
Interaction-level Membership Inference Attack Against Federated Recommender Systems
Yuan, W., Yang, C., Nguyen, Q. V. H., Cui, L., He, T., & Yin, H. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583359 · Cited by 72 · see citing works
User-Level Label Leakage from Gradients in Federated Learning
Wainakh, A., Ventola, F., Müßig, T., Keim, J., Cordero, C. G., Zimmer, E., Grube, T., Kristian Kersting, B., & Mühlhäuser, M. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0043 · Cited by 60 · see citing works
“This adversary mode is widely common in privacy attacks [30,37,26,41], where the focus is on disclosing information rather than disturbing the system.”
BackgroundGenerative Adversarial Networks: A Survey on Attack and Defense Perspective
Zhang, C., Yu, S., Tian, Z., & Yu, J. J. Q. (2023) · ACM Computing Surveys · doi:10.1145/3615336 · Cited by 62 · see citing works
“[144] proposed a client-launched membership inference attack whose targets are other clients in a FL system.”
BackgroundInfluentialSelf-citationDigestive neural networks: A novel defense strategy against inference attacks in federated learning
Lee, H.-K., Kim, J., Ahn, S.-Y., Hussain, R., Cho, S., & Son, J. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102378 · Cited by 57 · see citing works
“For instance, in ( Zhang et al., 2020a ), the authors utilized the quantization of parameters to reduce overhead.”
MethodInfluentialChen, J., Coyner, A. S., Chan, R. V. P., Hartnett, M. E., Moshfeghi, D. M., Owen, L. A., Kalpathy–Cramer, J., Chiang, M. F., & Campbell, J. P. (2021) · Ophthalmology Science · doi:10.1016/j.xops.2021.100079 · Cited by 56 · see citing works
Self-citationPrivacy-Enhancing Technologies in Federated Learning for the Internet of Healthcare Things: A Survey
Mosaiyebzadeh, F., Pouriyeh, S., Parizi, R. M., Sheng, Q. Z., Han, M., Zhao, L., Sannino, G., Ranieri, C. M., Ueyama, J., & Batista, D. M. (2023) · Electronics · doi:10.3390/electronics12122703 · Cited by 51 · see citing works
Madathil, N. T., Dankar, F. K., Gergely, M., Belkacem, A. N., & Alrabaee, S. (2025) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2025.06.009 · Cited by 52 · see citing works
“Another common inference attack is membership inference, which determines whether a specific sample was used for model training [206].”
Source Inference Attacks: Beyond Membership Inference Attacks in Federated Learning
Hu, H., Zhang, X., Salcic, Z. A., Sun, L., Choo, K. R., & Dobbie, G. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3321565 · Cited by 45 · see citing works
“Although FL has emerged as a popular privacy-aware learning paradigm, recent works [8], [9], [18], [33], [34], [35], [36] have demonstrated the success of MIAs on FL models.”
BackgroundFedSecurity: A Benchmark for Attacks and Defenses in Federated Learning and Federated LLMs
Han, S., Buyukates, B., Hu, Z., Jin, H., Jin, W., Sun, L., Wang, X., Wu, W., Xie, C., Yao, Y., et al. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671545 · Cited by 44 · see citing works
“We summarize the customization APIs in Table 3 and introduce each type of attacks in details.”
LaF: Lattice-Based and Communication-Efficient Federated Learning
Xu, P., Hu, M., Chen, T., Wang, W., & Jin, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3186739 · Cited by 40 · see citing works
Liu, G., Tian, Z., Chen, J., Wang, C., & Liu, J. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3303718 · Cited by 38 · see citing works
“bilities [13], [14], [15], intermediate computation results [16],”
Self-citationA survey on membership inference attacks and defenses in machine learning
Niu, J., Liu, P., Zhu, X., Shen, K., Wang, Y., Chi, H., Shen, Y., Jiang, X., Ma, J., & Zhang, Y. (2024) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2024.02.001 · Cited by 40 · see citing works
Majeed, A., Zhang, X., & Hwang, S. O. (2022) · Big Data and Cognitive Computing · doi:10.3390/bdcc6040127 · Cited by 35 · see citing works
“Zhang et al. [138] proposed a GAN-enhanced method for launching a membership inference attack in FL systems.”
MethodDHSA: efficient doubly homomorphic secure aggregation for cross-silo federated learning
Liu, Z., Chen, S., Ye, J., Fan, J., Li, H., & Li, X. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-022-04745-4 · Cited by 32 · see citing works
“For example, various membership inference approaches are introduced to verify if a record is in the training dataset based on the parameter updates [3, 5, 22]; property inference attacks [22] allow the adversaries to learn sensitive properties of individual training data; more seriously, DLG algorithm [7][23] is prese…”
Survey of Medical Applications of Federated Learning
Choi, G., Cha, W. C., Lee, S. U., & Shin, S.-Y. (2024) · Healthcare Informatics Research · doi:10.4258/hir.2024.30.1.3 · Cited by 32 · see citing works
“…for such attacks [86], an examination of inference attacks in vertical FL [87], an analysis of membership inference attacks that could lead to privacy breaches [88], and an investigation into source inference attacks that can extract more information than traditional inference methods [89].”
BackgroundOn the Differential Privacy in Federated Learning Based on Over-the-Air Computation
Park, S., & Choi, W. (2024) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2023.3316788 · Cited by 28 · see citing works
“…shown that the private information of devices can be revealed to others by various malicious attacks such as membership inference attacks [22], [23] to identify whether a specific data point is included in the private data or not, reconstruction attacks [24], [25] to partially reconstruct…”
BackgroundZhu, G., Li, D., Gu, H., Yao, Y., Fan, L., & Han, Y. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.01922 · Cited by 31 · see citing works
“Most existing MIAs in FL [24, 28, 29, 39, 45, 48] focus on inferring membership solely from the updates of the target clients , utilizing gradient norms, loss values, and gradient differences.”
Mishra, K. N., Bhattacharjee, V., Saket, S., & Mishra, S. P. (2022) · Cluster Computing · doi:10.1007/s10586-022-03813-x · Cited by 25 · see citing works
“The authors analyzed and compared the classification report for several optimization algorithms used in training, such as Stochastic Gradient Descend Optimizer, Momentum Optimizer, Adam Optimizer, and RMSprop Optimizer [73–75].”
InfluentialSandeepa, C., Siniarski, B., Wang, S., & Liyanage, M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00271 · Cited by 23 · see citing works
“These attacks then be a boosting technique for inference attacks to improve their attack success rate [6], [7].”
BackgroundMethodInfluentialZheng, Y., Chang, C.-H., Huang, S.-H., Chen, P., & Picek, S. (2024) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2024.3477348 · Cited by 27 · see citing works
“To enhance the performance of client-side MIA, Zhang et al. [142] utilized a GAN to enrich the training data for its membership classifier. al.”
Privacy-Preserving Federated Learning Using Homomorphic Encryption With Different Encryption Keys
Park, J., Yu, N. Y., & Lim, H. (2022) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc55196.2022.9952531 · Cited by 23 · see citing works
“Several attacks that violate the privacy of clients participating in the training were proposed by implementing reconstruction and membership inference attacks using GAN [7]–[9].”
MethodWainakh, A., Zimmer, E., Subedi, S., Keim, J., Grube, T., Karuppayah, S., Guinea, A. S., & Mühlhäuser, M. (2022) · Sensors · doi:10.3390/s23010031 · Cited by 24 · see citing works
“[21] 7 1 7 7 3 pt,kr,tf,sk 29 Zhang et al.”
BackgroundSeeing is believing: Towards interactive visual exploration of data privacy in federated learning
Guo, Y., Liu, F., Zhou, T., Cai, Z., & Xiao, N. (2022) · Information Processing & Management · doi:10.1016/j.ipm.2022.103162 · Cited by 22 · see citing works
Membership Inference Attacks Against Deep Learning Models via Logits Distribution
Yan, H., Li, S., Wang, Y., Zhang, Y., Sharif, K., Hu, H., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3222880 · Cited by 21 · see citing works
A Method to Improve the Privacy and Security for Federated Learning
Bai, Y., & Fan, M. (2021) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs52626.2021.9449214 · Cited by 20 · see citing works
“[11] introduces a GAN-based membership inference attack against federated learning, in which the curious participants can inference a sample whether within the training dataset.”
BackgroundBuilding Trusted Federated Learning: Key Technologies and Challenges
Chen, D., Jiang, X., Zhong, H., & Cui, J. (2023) · Journal of Sensor and Actuator Networks · doi:10.3390/jsan12010013 · Cited by 20 · see citing works
“The work in [53] considers the use of GAN to generate enriched attack data for the shadow model, which in turn improves the accuracy of member inference attacks to 98%.”
Federify: A Verifiable Federated Learning Scheme Based on zkSNARKs and Blockchain
Keshavarzkalhori, G., Pérez‐Solà, C., Navarro‐Arribas, G., Herrera‐Joancomartí, J., & Yajam, H. A. (2023) · IEEE Access · doi:10.1109/access.2023.3347039 · Cited by 18 · see citing works
“The common privacy attacks in FL are : Membership inference attacks: in this case, the attacker attempts to determine if some specific data is part of the training data set [14], [25], [28], [43].”
BackgroundBenchmarking robustness and privacy-preserving methods in federated learning
Alebouyeh, Z., & Bidgoly, A. J. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.01.009 · Cited by 17 · see citing works
PSFL: Ensuring Data Privacy and Model Security for Federated Learning
Li, J., Tian, Y., Zhou, Z., Xiang, A., Wang, S., & Xiong, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3394168 · Cited by 16 · see citing works
“On the premise of obtaining the model parameters, the attackers can infer the data samples of the user data [12], or deduce the attribute characteristics of user data [13].”
BackgroundGANMIA: GAN-based Black-box Membership Inference Attack
Bai, Y., Chen, D., Chen, T., & Fan, M. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500657 · Cited by 16 · see citing works
“Zhang et al. [17] apply GAN in MIA against federated learning.”
BackgroundWang, X., Wu, L., & Guan, Z. (2023) · Information Sciences · doi:10.1016/j.ins.2023.120068 · Cited by 15 · see citing works
A Distributed Generative Adversarial Network for Data Augmentation Under Vertical Federated Learning
Xiao, Y., Li, X., Li, T., Wang, R., Pang, Y., & Wang, G. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3375150 · Cited by 15 · see citing works
A Survey on Privacy of Personal and Non-Personal Data in B5G/6G Networks
Sandeepa, C., Siniarski, B., Kourtellis, N., Wang, S., & Liyanage, M. (2024) · ACM Computing Surveys · doi:10.1145/3662179 · Cited by 16 · see citing works
“Particularly in a data-driven industry that is data-hungry, the line between supplying useful information and being exploited for monetary gain is thin.”
BackgroundInfluentialElZemity, A., & Arief, B. (2024) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics62450.2024.00072 · Cited by 16 · see citing works
“[17], [18], [19], [20], [21], [22], [23], [24], [25], [26] Poisoning Attacks [27], [28], [29], [30] Eavesdropping [31], [32], [33] Sybil Attacks [34], [35], [36] Backdoor Attacks [37], [38], [39], [40] Gradient Leakage [41] Reconstruction [42], [43] 2) Poisoning Attacks: Adversaries intentionally…”
BackgroundA hybrid and efficient Federated Learning for privacy preservation in IoT devices
Cao, S., Liu, S., Yang, Y., Du, W., Zhan, Z., Wang, D., & Zhang, W. (2025) · Ad Hoc Networks · doi:10.1016/j.adhoc.2025.103761 · Cited by 15 · see citing works
Jithish, J., Mahalingam, N., Wang, B., & Yeo, K. S. (2025) · Cybersecurity · doi:10.1186/s42400-024-00350-5 · Cited by 15 · see citing works
FedIMP: Parameter Importance-based Model Poisoning attack against Federated learning system
Li, X., Wang, N., Yuan, S., & Guan, Z. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103936 · Cited by 14 · see citing works
Security and Privacy Challenges of AIGC in Metaverse: A Comprehensive Survey
Zhang, S., Li, H., Sun, K., Chen, H., Wang, Y., & Li, S. (2025) · ACM Computing Surveys · doi:10.1145/3729419 · Cited by 16 · see citing works
On Defensive Neural Networks Against Inference Attack in Federated Learning
Lee, H.-K., Kim, J., Hussain, R., Cho, S., & Son, J. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500936 · Cited by 14 · see citing works
“Similarly, inference attacks based on Generative Adversarial Networks (GAN) exploiting the white-box setting are also introduced [6], [7].”
BackgroundA Survey on Blockchain-Based Federated Learning: Categorization, Application and Analysis
Tang, Y., Zhang, Y., Niu, T., Li, Z., Zhang, Z., Chen, H., & Zhang, L. (2024) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2024.030084 · Cited by 20 · see citing works
A Framework to Design Efficent Blockchain-Based Decentralized Federated Learning Architectures
Formery, Y., Mendiboure, L., Villain, J., Deniau, V., & Gransart, C. (2024) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2024.3488512 · Cited by 13 · see citing works
User Label Leakage from Gradients in Federated Learning.Preprint
Wainakh, A., Ventola, F., Müßig, T., Keim, J., Cordero, C. G., Zimmer, E., Grube, T., Kristian Kersting, B., & Mühlhäuser, M. (2021) · arXiv (Cornell University) · Cited by 13 · see citing works
Blockchain-based decentralized federated learning: A secure and privacy-preserving system
Zhao, S., Wu, Y., Sun, R., Qian, X., Zi, D., Xie, Z., Tong, E., Niu, W., Liu, J., & Han, Z. (2021) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys53884.2021.00150 · Cited by 12 · see citing works
An Empirical Evaluation of the Data Leakage in Federated Graph Learning
Chen, J., Ma, M., Ma, H., Zheng, H., & Zhang, J. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3326359 · Cited by 13 · see citing works
“For instance, Zhang et al. [39] launched an attack on honest participants in federated learning by using privacy inference attacks in a black-box environment to obtain sensitive records in training data.”
BackgroundSelf-citationFu, X., Xiong, L., Li, F., Yang, X., & Xiong, N. N. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3439437 · Cited by 11 · see citing works
“For example, an attack method using Generative Adversarial Networks (GANs) was proposed in [13] that strengthens the membership privacy attack further exposing the participants’ privacy by performing active, collaboration-free attacks on the local model.”
Amiri, S., Belloum, A. S. Z., Nalisnick, E., Klous, S., & Gommans, L. (2022) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w54100.2022.00018 · Cited by 12 · see citing works
“However, it has been shown that FL by itself does not guarantee privacy and has been known to be vulnerable to different adversarial attacks such as Membership Inference Attacks [2], [3], Reconstruction Attacks [4], [5] and Inversion Attacks [6], [7].”
Defending against Membership Inference Attacks in Federated learning via Adversarial Example
Xie, Y., Chen, B., Zhang, J., & Wu, D. (2021) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn53354.2021.00036 · Cited by 12 · see citing works
Self-citationSandeepa, C., Siniarski, B., Wang, S., & Liyanage, M. (2023) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2023.3333560 · Cited by 11 · see citing works
“A Generative Adversarial Network (GAN)-based membership inference attack on FL is proposed in [3].”
BackgroundMethodResultInfluentialGenerative Image Reconstruction From Gradients
Sotthiwat, E., Zhen, L., Zhang, C., Li, Z., & Goh, R. S. M. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3383722 · Cited by 11 · see citing works
“For the first types of leakage information, the membership inference attacks [2], [3], [18], [19] are able to distinguish whether the selected data is or is not trained in the centralized FL.”
A Secure Object Detection Technique for Intelligent Transportation Systems
Mia, M. J., & Amini, M. H. (2024) · IEEE Open Journal of Intelligent Transportation Systems · doi:10.1109/ojits.2024.3440876 · Cited by 11 · see citing works
“In inference attacks, an attacker can deduce confidential information by analyzing the global model or from the communication channel [24], [25].”
BackgroundDGGI: Deep Generative Gradient Inversion with diffusion model
Wu, L., Liu, Z., Pu, B., Wei, K., Cao, H., & Yao, S. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102620 · Cited by 11 · see citing works
Enhancing Cybersecurity in smart grid: a review of machine learning approaches
Hamdi, N. (2025) · Telecommunication Systems · doi:10.1007/s11235-025-01308-9 · Cited by 10 · see citing works
Naseri, M., Han, Y., Mariconti, E., Shen, Y. C., Stringhini, G., & Cristofaro, E. D. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560580 · Cited by 9 · see citing works
Wang, N., Xiao, Y., Chen, Y., Zhang, N., Lou, W., & Hou, Y. T. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3564652 · Cited by 9 · see citing works
“Further, an adversary [19, 32] can differentiate whether one data record is in the training dataset or not by accessing only the model.”
BackgroundSubject-Level Membership Inference Attack via Data Augmentation and Model Discrepancy
Liu, Y., Jiang, P., & Zhu, L. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3318950 · Cited by 9 · see citing works
“• Prior Dataset: Similar to the previous MIAs [22], [23], [24], we assume that the adversary possesses a limited prior dataset, which pertains to their curious federated users.”
BackgroundMethodALGANs: Enhancing membership inference attacks in federated learning with GANs and active learning
Xie, Y., Chen, B., Zhang, J., & Li, W. (2022) · IEEE International Symposium on Product Compliance Engineering - Asia (ISPCE-ASIA) · doi:10.1109/ispce-asia57917.2022.9971068 · Cited by 9 · see citing works
“However, the lack of attack data is still a challenge that makes the attack less successful [4].”
BackgroundMethodResultInfluentialSelf-citationTowards Privacy-Preserving Federated Neuromorphic Learning via Spiking Neuron Models
Han, B., Fu, Q., & Zhang, X. (2023) · Electronics · doi:10.3390/electronics12183984 · Cited by 9 · see citing works
Privacy of the Metaverse: Current Issues, AI Attacks, and Possible Solutions
Sandeepa, C., Wang, S., & Liyanage, M. (2023) · IEEE International Conference on Metaverse Computing, Networking and Applications (MetaCom) · doi:10.1109/metacom57706.2023.00052 · Cited by 9 · see citing works
“These representative data records can be generated using generative models such as Generative Adversarial Networks (GAN) [46].”
MethodFederated Analytics With Data Augmentation in Domain Generalization Toward Future Networks
Zhang, X., Parra-Ullauri, J. M., Moazzeni, S., Vasilakos, X., Nejabati, R., & Simeonidou, D. E. (2024) · IEEE Transactions on Machine Learning in Communications and Networking · doi:10.1109/tmlcn.2024.3393892 · Cited by 9 · see citing works
“The work in [44] uses GANs to enrich attack data.”
MethodSniper Backdoor: Single Client Targeted Backdoor Attack in Federated Learning
Abad, G., Paguada, S., Ersoy, O., Picek, S., Ramírez-Durán, V. J., & Urbieta, A. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00033 · Cited by 9 · see citing works
“Concerning security, GANs have also played an important role, performing inference attacks [53] or generating adversarial examples [49].”
BackgroundZhao, H., Pan, C., Liu, M., Jiao, D., & Zhu, H. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3568030 · Cited by 9 · see citing works
“Current privacy threats have encompassed membership inference attacks [16], attribute inference attacks [17], [18], GANs inference attacks [19], and reconstruction inference attacks [20], [21].”
GBMIA: Gradient-based Membership Inference Attack in Federated Learning
Wang, X., Wang, N., Wu, L., Guan, Z., Du, X., & Guizani, M. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10279702 · Cited by 8 · see citing works
“Zhang et al. [9] utilized generative adversarial networks to produce and enrich the attack model’s training data, but it does not reduce the overhead and complexity of the attack model-based MIAs.”
BackgroundMarking the Pace: A Blockchain-Enhanced Privacy-Traceable Strategy for Federated Recommender Systems
Cai, Z., Tang, T., Yu, S., Xiao, Y.-P., & Xia, F. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3329363 · Cited by 11 · see citing works
“Therefore, lacking traceability, the recommendation process could suffer malicious manipulation [36], [37], [38], further posing trust-related risks [39], [40].”
BackgroundSelf-citationKaushal, V., & Sharma, S. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02339-z · Cited by 7 · see citing works
“…of attacks can be launched against federated learning systems [7], including data poisoning attacks [8], model poisoning attacks [9], backdoor attacks [10], Byzantine attacks [11], membership inference attacks [12], model inversion attacks [13], Sybil attacks [14], and eavesdropping attacks [15].”
Xiao, Y., Zhao, D., Li, X., Li, T., Wang, R., & Wang, G. (2025) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2025.3553501 · Cited by 7 · see citing works
“Theirlinesofresearchincludedataaug-mentationmethodsunderfederatedlearning[14],[15],[16], [17],mitigateheterogeneityforwidelyvaryingmulti-source data[18],[19],[20],encryptingtheoriginaldatawithencryption computationanddesigningdifferentdifferentialprivacymech-anisms[21],[22].”
From Opacity to Clarity: Leveraging XAI for Robust Network Traffic Classification
Sandeepa, C., Senevirathna, T., Siniarski, B., Nguyen, M.-D., La, V.-H., Wang, S., & Liyanage, M. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-51135-6_11 · Cited by 7 · see citing works
Federated Learning With Heterogeneous Client Expectations: A Game Theory Approach
Shen, S., Liu, C., & Lim, T. J. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3464488 · Cited by 6 · see citing works
“Second, FL has been proven to be vulnerable to some attacks such as model inversion attacks [8], [9] and membership inference attacks [10], [11], [12], [13] which result in data privacy leakage.”
BackgroundSecuring Federated Learning in IoT: A Survey of Attacks, Defenses, and Frameworks
Atia, O. B., Samara, M. A., Bennis, I., Gaber, J., Abouaïssa, A., & Lorenz, P. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600617 · Cited by 6 · see citing works
“Techniques, such as the one proposed by [56] demonstrate the nuanced approach required to successfully execute membership attacks, underscoring the sophisticated nature of threats facing FL environments.”
Aziz, R., Banerjee, S., & Bouzefrane, S. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-60391-4_11 · Cited by 6 · see citing works
Li, H., & Huang, J. (2024) · Vehicular Communications · doi:10.1016/j.vehcom.2024.100853 · Cited by 6 · see citing works
Black-Box Based Limited Query Membership Inference Attack
Zhang, Y., Zhou, H., Wang, P., & Yang, G. (2022) · IEEE Access · doi:10.1109/access.2022.3175824 · Cited by 6 · see citing works
“Based on this, Marza et al.[23] proposed the CGAN model, which is an effective improvement on the original GAN.”
BackgroundMethodFabricated Flips: Poisoning Federated Learning without Data
Huang, J., Zhao, Z., Chen, L. Y., & Roos, S. (2023) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58367.2023.00036 · Cited by 6 · see citing works
“Our attack uses a generator, as do other attacks but for highly different scenarios or goals: attacking centralized learning [51, 54], attacking privacy [36, 55], or mimicking prototypical samples of the other participants’ training set with the goal of targeted attacks [52, 53].”
BackgroundRobust and privacy-preserving collaborative training: a comprehensive survey
Yang, F., Zhang, X., Guo, S., Chen, D., Gan, Y., Xiang, T., & Liu, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10797-0 · Cited by 15 · see citing works
FDP-FL: differentially private federated learning with flexible privacy budget allocation
Wenjun, Q., Shen, Q., Chen, X., Li, C., Fang, Y., & Wu, Z. (2024) · The Computer Journal · doi:10.1093/comjnl/bxae081 · Cited by 5 · see citing works
Qin, X. R., Yang, X. S., & Tang, X. (2025) · Pattern Recognition · doi:10.1016/j.patcog.2025.112174 · Cited by 5 · see citing works
Feng, S., Mohammady, M., Hong, H., Yan, S., Kundu, A., Wang, B., & Hong, Y. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726517 · Cited by 7 · see citing works
Investigated Insider and Outsider Attacks on the Federated Learning Systems
Ahmed, I. M., & Kashmoola, M. Y. (2022) · IEEE International Conference on Communication, Networks and Satellite (COMNETSAT) · doi:10.1109/comnetsat56033.2022.9994330 · Cited by 6 · see citing works
“Jingwen Zhang et al. [14], Federated Learning is susceptible to a major privacy breach due to a method of attack using membership inference.”
BackgroundMethodInfluentialMishra, K. N., Bhattacharjee, V., Saket, S., & Mishra, S. P. (2022) · Research Square · doi:10.21203/rs.3.rs-1714576/v1 · Cited by 5 · see citing works
Haghbin, Y., Badiei, M. H., Tran, N. H. K., & Piran, M. J. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3571688 · Cited by 4 · see citing works
“Beyond their defensive applications, GANs’ ability to generate enriched and diverse synthetic data sometimes benefits the adversary, where using synthetic data within training can strengthen some attacks and challenge privacy in FL [44], [45].”
Zuo, C., Xu, P., Song, Y., Lu, J., Yuan, C., & Li, Y. (2025) · Scientific Reports · doi:10.1038/s41598-025-16830-8 · Cited by 4 · see citing works
Efficient Byzantine-Robust Privacy-Preserving Federated Learning via Dimension Compression
Qin, X. R., Yang, X. S., & Tang, X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3671104 · Cited by 4 · see citing works
“Research [5], [6], [7] indicates that model updates can leak sensitive information about local data, even without direct data sharing.”
Campus Network Intrusion Detection based on Federated Learning
Chen, J., Guo, Q., Fu, Z., Shang, Q., Ma, H., & Wu, D. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892843 · Cited by 4 · see citing works
“…Settings: Although federated learning can protect data privacy of participants by only uploading local model parameters, it still faces challenges such as Data Reconstruction Attacks [18], Membership-Inference Attacks [19], Model Inversion Attacks [20], Poisoning Attacks [21], and other threats.”
BackgroundSelf-citationA Privacy-Enhancing Mechanism for Federated Graph Neural Networks
Tang, X., & Hu, F. (2025) · Symmetry · doi:10.3390/sym17040565 · Cited by 4 · see citing works
Personalized Differential Privacy Federated Learning Model for Internet of Vehicles
Zhang, L., Zuo, J., Lu, Y., & Zou, S. (2024) · IEEE Smart World Congress (SWC) · doi:10.1109/swc62898.2024.00349 · Cited by 2 · see citing works
“Li et al. [16] measure the degree of privacy leakage in federated learning using gradient leakage attacks, while Zhang et al. [17] analyze the privacy leakage risks revealed by membership inference attacks.”
Liu, G., Xu, T., Yang, Y., Abdelmoniem, A. M., Wang, C., & Liu, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3564697 · Cited by 2 · see citing works
“Considering the difficulty to acquire a training set with the same distribution as the target model, Zhang et al. [42] use generative adversarial networks to generate the training data of the target client, making the attack possible under the iid condition.”
CGGL: A client-side generative gradient leakage attack with double diffusion prior
Pu, B., Liu, Z., Wu, L., Xu, K., Liang, B., He, Z., Ma, B., & Zhao, L. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103292 · Cited by 2 · see citing works
Towards efficient and secure vertical federated learning with additive ensemble
Wang, S., Chen, Z., Liu, L., & Xu, W. (2026) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-025-02897-2 · Cited by 2 · see citing works
“We validated our method by performing classification and regression tasks on multiple datasets, and demonstrated that our method can greatly improve model accuracy in bothtypesoftasks,whileeffectivelyalleviatingthemost common attack in VFL - label inference attack [25, 38].”
- Authors
- Zhang, J., Zhang, J., Chen, J., & Yu, S.
- Affiliations
- University of Technology Sydney (AU)
- Beijing University of Chemical Technology (CN)
- Venue
- ICC 2020 - 2020 IEEE International Conference on Communications (ICC)
- Publisher
- IEEE
- Published
- 2020-06
- Pages
- 1-6
- ISSN
- 1550-3607 (ISSN-L)
- OpenAlex
- W3045720734
- Cited by
- 133
- References
- 25
- Citations by year
- 2026: 5 · 2025: 29 · 2024: 39 · 2023: 26 · 2022: 25 · 2021: 9
- FWCI
- 5.72
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- International Conference on Communications (publishedVersion)
- OPUS - Open Publications of UTS Scholars (University of Technology Sydney) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, federated learning, generative adversarial networks, privacy leakage, data diversity, overfitting, federated learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
