The DOI matches its Crossref record; 25 of the 25 references it cites were found in a registry or an index.
GAN Enhanced Membership Inference: A Passive Local Attack in Federated Learning
Abstract
Federated learning has lately received great attention for its privacy protection feature. However, recent researches found that federated learning models are susceptible to various inference attacks. In this paper, we point out a membership inference attack method that can cause a serious privacy leakage in federated learning. An adversary who is a participant in federated learning can train a classification attack model to launch the membership inference attack, which determines if a data record is in the model's training dataset. The existing membership inference method is dissatisfied due to a lack of attack data since the training data of each participant are independent. To overcome the lack of attack data, an adversary can enrich attack data using the generative adversarial network (GAN), which is a practical method to increase data diversity. We substantiate that this GAN enhanced membership inference attack method has a 98% attack accuracy. We perform experiments to show that data diversity and the overfitting make federated learning models susceptible.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“The fake parameter update from an adversary is also a security bottleneck [81] which can impersonate a certain client and broadcast fake parameters.”
From Federated learning meets blockchain in edge computing: Opportunities and challenges (2021) · cites this paper as [81]
Citations
Cites
Labaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Conditional Generative Adversarial Nets
Mirza, M., & Osindero, S. (2014) · arXiv · doi:10.48550/arxiv.1411.1784 · Cited by 8,863
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377
Cited by
Sorted by citations
Federated learning meets blockchain in edge computing: Opportunities and challenges
Nguyen, D. C., Ding, M., Pham, Q.-V., Pathirana, P. N., Le, L. B., Seneviratne, A., Li, J., Niyato, D., & Poor, H. V. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3072611 · Cited by 661
Membership Inference Attacks on Machine Learning: A Survey
Hu, H., Salcic, Z. A., Sun, L., Dobbie, G., Yu, P. S., & Zhang, X. (2022) · ACM Computing Surveys · doi:10.1145/3523273 · Cited by 662
“• Attack F1-score [162] ([65, 76, 134, 164, 215, 237, 239]) Attack F1-score is the harmonic mean of Attack Precision and Attack Recall:”
BackgroundDistributed Artificial Intelligence Empowered by End-Edge-Cloud Computing: A Survey
Duan, S., Wang, D., Ren, J., Lyu, F., Zhang, Y., Wu, H., & Shen, X. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3218527 · Cited by 439
“Considering the lack of target training data in practice, Zhang et al. [227] used GAN to generate samples that have the same distribution as the original data records to fill the gap in attack data.”
MethodBlockchain-Based Federated Learning for Securing Internet of Things: A Comprehensive Survey
Issa, W., Moustafa, N., Turnbull, B., Sohrabi, N., & Tari, Z. (2022) · ACM Computing Surveys · doi:10.1145/3560816 · Cited by 347
“[174] proposed a passive membership attack that malicious participants in FL can perform.”
BackgroundRodríguez-Barroso, N., Jiménez-López, D., Luzón, M. V., Herrera, F., & Martínez-Cámara, E. (2023) · Information Fusion · doi:10.1016/j.inffus.2022.09.011 · Cited by 296
“[75] is a great example of using a GAN architecture for data augmentation to boost the effectiveness of the passive attacker with client-side knowledge from Nasr et al.”
MethodA Privacy-Aware and Incremental Defense Method Against GAN-Based Poisoning Attack
Qiao, F., Li, Z., & Kong, Y. (2023) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2023.3263241 · Cited by 222
“Thus, adversaries can utilize GAN to generate fake data close to the distribution of other participants’ data, which can become training datasets for other attacks of privacy leak, such as the membership inference attack [18], [19].”
BackgroundThe Impact of Adversarial Attacks on Federated Learning: A Survey
Kumar, K. N., Mohan, C. K., & Cenkeramaddi, L. R. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2023.3322785 · Cited by 209
Membership Inference Attacks and Defenses in Federated Learning: A Survey
Bai, L., Hu, H., Ye, Q., Li, H., Wang, L., & Xu, J. (2024) · ACM Computing Surveys · doi:10.1145/3704633 · Cited by 179
“From the perspective of the central server, this is intuitively equivalent to using record-level MIAs to sequentially infer the membership status of each local model [27, 61].”
InfluentialAn overview of implementing security and privacy in federated learning
Hu, K., Gong, S., Zhang, Q., Seng, C., Xia, M., & Jiang, S. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10846-8 · Cited by 175
Aziz, R., Banerjee, S., Bouzefrane, S., & Vinh, T. L. (2023) · Future Internet · doi:10.3390/fi15090310 · Cited by 149
Privacy and Fairness in Federated Learning: On the Perspective of Tradeoff
Chen, H., Zhu, T., Zhang, T., Zhou, W., & Yu, P. S. (2023) · ACM Computing Surveys · doi:10.1145/3606017 · Cited by 118
“set [75, 220] or, even worse, reconstruct the training data [59].”
BackgroundMohammadi, S., Balador, A., Sinaei, S., & Flammini, F. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104918 · Cited by 93
Federated Domain Generalization: A Survey
Li, Y., Wang, X., Zeng, R., Donta, P. K., Murturi, I., Huang, M., & Dustdar, S. (2025) · Proceedings of the IEEE · doi:10.1109/jproc.2025.3596173 · Cited by 102
“Zhang et al. [79] leveraged GANs to generate synthetic data with the same underlying distribution as the original dataset, guided by the target FL model’s discriminator, thereby enriching the training dataset and improving the imitative capability of the generated images.”
Interaction-level Membership Inference Attack Against Federated Recommender Systems
Yuan, W., Yang, C., Nguyen, Q. V. H., Cui, L., He, T., & Yin, H. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583359 · Cited by 90
User-Level Label Leakage from Gradients in Federated Learning
Wainakh, A., Ventola, F., Müßig, T., Keim, J., Cordero, C. G., Zimmer, E., Grube, T., Kersting, K., & Mühlhäuser, M. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0043 · Cited by 103
“This adversary mode is widely common in privacy attacks [30,37,26,41], where the focus is on disclosing information rather than disturbing the system.”
BackgroundGenerative Adversarial Networks: A Survey on Attack and Defense Perspective
Zhang, C., Yu, S., Tian, Z., & Yu, J. J. Q. (2023) · ACM Computing Surveys · doi:10.1145/3615336 · Cited by 69
“[144] proposed a client-launched membership inference attack whose targets are other clients in a FL system.”
BackgroundInfluentialSelf-citationDigestive neural networks: A novel defense strategy against inference attacks in federated learning
Lee, H.-K., Kim, J., Ahn, S.-Y., Hussain, R., Cho, S., & Son, J. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102378 · Cited by 57
“For instance, in ( Zhang et al., 2020a ), the authors utilized the quantization of parameters to reduce overhead.”
MethodInfluentialChen, J., Coyner, A. S., Chan, R. V. P., Hartnett, M. E., Moshfeghi, D. M., Owen, L. A., Kalpathy–Cramer, J., Chiang, M. F., & Campbell, J. P. (2021) · Ophthalmology Science · doi:10.1016/j.xops.2021.100079 · Cited by 56
Self-citationPrivacy-Enhancing Technologies in Federated Learning for the Internet of Healthcare Things: A Survey
Mosaiyebzadeh, F., Pouriyeh, S., Parizi, R. M., Sheng, Q. Z., Han, M., Zhao, L., Sannino, G., Ranieri, C. M., Ueyama, J., & Batista, D. M. (2023) · Electronics · doi:10.3390/electronics12122703 · Cited by 51
Madathil, N. T., Dankar, F. K., Gergely, M., Belkacem, A. N., & Alrabaee, S. (2025) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2025.06.009 · Cited by 58
“Another common inference attack is membership inference, which determines whether a specific sample was used for model training [206].”
Source Inference Attacks: Beyond Membership Inference Attacks in Federated Learning
Hu, H., Zhang, X., Salcic, Z. A., Sun, L., Choo, K. R., & Dobbie, G. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3321565 · Cited by 47
“Although FL has emerged as a popular privacy-aware learning paradigm, recent works [8], [9], [18], [33], [34], [35], [36] have demonstrated the success of MIAs on FL models.”
BackgroundFedSecurity: A Benchmark for Attacks and Defenses in Federated Learning and Federated LLMs
Han, S., Buyukates, B., Hu, Z., Jin, H., Jin, W., Sun, L., Wang, X., Wu, W., Xie, C., Yao, Y., et al. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671545 · Cited by 55
“We summarize the customization APIs in Table 3 and introduce each type of attacks in details.”
LaF: Lattice-Based and Communication-Efficient Federated Learning
Xu, P., Hu, M., Chen, T., Wang, W., & Jin, H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3186739 · Cited by 40
Liu, G., Tian, Z., Chen, J., Wang, C., & Liu, J. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3303718 · Cited by 39
“bilities [13], [14], [15], intermediate computation results [16],”
Self-citationA survey on membership inference attacks and defenses in machine learning
Niu, J., Liu, P., Zhu, X., Shen, K., Wang, Y., Chi, H., Shen, Y., Jiang, X., Ma, J., & Zhang, Y. (2024) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2024.02.001 · Cited by 51
Majeed, A., Zhang, X., & Hwang, S. O. (2022) · Big Data and Cognitive Computing · doi:10.3390/bdcc6040127 · Cited by 37
“Zhang et al. [138] proposed a GAN-enhanced method for launching a membership inference attack in FL systems.”
MethodDHSA: efficient doubly homomorphic secure aggregation for cross-silo federated learning
Liu, Z., Chen, S., Ye, J., Fan, J., Li, H., & Li, X. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-022-04745-4 · Cited by 35
“For example, various membership inference approaches are introduced to verify if a record is in the training dataset based on the parameter updates [3, 5, 22]; property inference attacks [22] allow the adversaries to learn sensitive properties of individual training data; more seriously, DLG algorithm [7][23] is prese…”
Survey of Medical Applications of Federated Learning
Choi, G., Cha, W. C., Lee, S. U., & Shin, S.-Y. (2024) · Healthcare Informatics Research · doi:10.4258/hir.2024.30.1.3 · Cited by 33
“…for such attacks [86], an examination of inference attacks in vertical FL [87], an analysis of membership inference attacks that could lead to privacy breaches [88], and an investigation into source inference attacks that can extract more information than traditional inference methods [89].”
BackgroundOn the Differential Privacy in Federated Learning Based on Over-the-Air Computation
Park, S., & Choi, W. (2023) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2023.3316788 · Cited by 34
“…shown that the private information of devices can be revealed to others by various malicious attacks such as membership inference attacks [22], [23] to identify whether a specific data point is included in the private data or not, reconstruction attacks [24], [25] to partially reconstruct…”
BackgroundZhu, G., Li, D., Gu, H., Yao, Y., Fan, L., & Han, Y. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.01922 · Cited by 42
“Most existing MIAs in FL [24, 28, 29, 39, 45, 48] focus on inferring membership solely from the updates of the target clients , utilizing gradient norms, loss values, and gradient differences.”
Mishra, K. N., Bhattacharjee, V., Saket, S., & Mishra, S. P. (2022) · Cluster Computing · doi:10.1007/s10586-022-03813-x · Cited by 25
“The authors analyzed and compared the classification report for several optimization algorithms used in training, such as Stochastic Gradient Descend Optimizer, Momentum Optimizer, Adam Optimizer, and RMSprop Optimizer [73–75].”
InfluentialSandeepa, C., Siniarski, B., Wang, S., & Liyanage, M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00271 · Cited by 23
“These attacks then be a boosting technique for inference attacks to improve their attack success rate [6], [7].”
BackgroundMethodInfluentialZheng, Y., Chang, C.-H., Huang, S.-H., Chen, P., & Picek, S. (2024) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2024.3477348 · Cited by 31
“To enhance the performance of client-side MIA, Zhang et al. [142] utilized a GAN to enrich the training data for its membership classifier. al.”
Privacy-Preserving Federated Learning Using Homomorphic Encryption With Different Encryption Keys
Park, J., Yu, N. Y., & Lim, H. (2022) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc55196.2022.9952531 · Cited by 26
“Several attacks that violate the privacy of clients participating in the training were proposed by implementing reconstruction and membership inference attacks using GAN [7]–[9].”
MethodWainakh, A., Zimmer, E., Subedi, S., Keim, J., Grube, T., Karuppayah, S., Guinea, A. S., & Mühlhäuser, M. (2022) · Sensors · doi:10.3390/s23010031 · Cited by 26
“[21] 7 1 7 7 3 pt,kr,tf,sk 29 Zhang et al.”
BackgroundSeeing is believing: Towards interactive visual exploration of data privacy in federated learning
Guo, Y., Liu, F., Zhou, T., Cai, Z., & Xiao, N. (2022) · Information Processing & Management · doi:10.1016/j.ipm.2022.103162 · Cited by 22
Membership Inference Attacks Against Deep Learning Models via Logits Distribution
Yan, H., Li, S., Wang, Y., Zhang, Y., Sharif, K., Hu, H., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3222880 · Cited by 24
A Method to Improve the Privacy and Security for Federated Learning
Bai, Y., & Fan, M. (2021) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs52626.2021.9449214 · Cited by 20
“[11] introduces a GAN-based membership inference attack against federated learning, in which the curious participants can inference a sample whether within the training dataset.”
BackgroundBuilding Trusted Federated Learning: Key Technologies and Challenges
Chen, D., Jiang, X., Zhong, H., & Cui, J. (2023) · Journal of Sensor and Actuator Networks · doi:10.3390/jsan12010013 · Cited by 21
“The work in [53] considers the use of GAN to generate enriched attack data for the shadow model, which in turn improves the accuracy of member inference attacks to 98%.”
Federify: A Verifiable Federated Learning Scheme Based on zkSNARKs and Blockchain
Keshavarzkalhori, G., Pérez‐Solà, C., Navarro‐Arribas, G., Herrera‐Joancomartí, J., & Yajam, H. A. (2023) · IEEE Access · doi:10.1109/access.2023.3347039 · Cited by 18
“The common privacy attacks in FL are : Membership inference attacks: in this case, the attacker attempts to determine if some specific data is part of the training data set [14], [25], [28], [43].”
BackgroundBenchmarking robustness and privacy-preserving methods in federated learning
Alebouyeh, Z., & Bidgoly, A. J. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.01.009 · Cited by 19
PSFL: Ensuring Data Privacy and Model Security for Federated Learning
Li, J., Tian, Y., Zhou, Z., Xiang, A., Wang, S., & Xiong, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3394168 · Cited by 17
“On the premise of obtaining the model parameters, the attackers can infer the data samples of the user data [12], or deduce the attribute characteristics of user data [13].”
BackgroundGANMIA: GAN-based Black-box Membership Inference Attack
Bai, Y., Chen, D., Chen, T., & Fan, M. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500657 · Cited by 17
“Zhang et al. [17] apply GAN in MIA against federated learning.”
BackgroundWang, X., Wu, L., & Guan, Z. (2023) · Information Sciences · doi:10.1016/j.ins.2023.120068 · Cited by 15
A Distributed Generative Adversarial Network for Data Augmentation Under Vertical Federated Learning
Xiao, Y., Li, X., Li, T., Wang, R., Pang, Y., & Wang, G. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3375150 · Cited by 15
A Survey on Privacy of Personal and Non-Personal Data in B5G/6G Networks
Sandeepa, C., Siniarski, B., Kourtellis, N., Wang, S., & Liyanage, M. (2024) · ACM Computing Surveys · doi:10.1145/3662179 · Cited by 18
“Particularly in a data-driven industry that is data-hungry, the line between supplying useful information and being exploited for monetary gain is thin.”
BackgroundInfluentialElZemity, A., & Arief, B. (2024) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics62450.2024.00072 · Cited by 16
“[17], [18], [19], [20], [21], [22], [23], [24], [25], [26] Poisoning Attacks [27], [28], [29], [30] Eavesdropping [31], [32], [33] Sybil Attacks [34], [35], [36] Backdoor Attacks [37], [38], [39], [40] Gradient Leakage [41] Reconstruction [42], [43] 2) Poisoning Attacks: Adversaries intentionally…”
BackgroundA hybrid and efficient Federated Learning for privacy preservation in IoT devices
Cao, S., Liu, S., Yang, Y., Du, W., Zhan, Z., Wang, D., & Zhang, W. (2025) · Ad Hoc Networks · doi:10.1016/j.adhoc.2025.103761 · Cited by 17
Jithish, J., Mahalingam, N., Wang, B., & Yeo, K. S. (2025) · Cybersecurity · doi:10.1186/s42400-024-00350-5 · Cited by 15
FedIMP: Parameter Importance-based Model Poisoning attack against Federated learning system
Li, X., Wang, N., Yuan, S., & Guan, Z. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103936 · Cited by 14
Security and Privacy Challenges of AIGC in Metaverse: A Comprehensive Survey
Zhang, S., Li, H., Sun, K., Chen, H., Wang, Y., & Li, S. (2025) · ACM Computing Surveys · doi:10.1145/3729419 · Cited by 17
On Defensive Neural Networks Against Inference Attack in Federated Learning
Lee, H.-K., Kim, J., Hussain, R., Cho, S., & Son, J. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500936 · Cited by 14
“Similarly, inference attacks based on Generative Adversarial Networks (GAN) exploiting the white-box setting are also introduced [6], [7].”
BackgroundA Survey on Blockchain-Based Federated Learning: Categorization, Application and Analysis
Tang, Y., Zhang, Y., Niu, T., Li, Z., Zhang, Z., Chen, H., & Zhang, L. (2024) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2024.030084 · Cited by 21
A Framework to Design Efficent Blockchain-Based Decentralized Federated Learning Architectures
Formery, Y., Mendiboure, L., Villain, J., Deniau, V., & Gransart, C. (2024) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2024.3488512 · Cited by 13
User Label Leakage from Gradients in Federated Learning.Preprint
Wainakh, A., Ventola, F., Müßig, T., Keim, J., Cordero, C. G., Zimmer, E., Grube, T., Kristian Kersting, B., & Mühlhäuser, M. (2021) · arXiv (Cornell University) · Cited by 13
Blockchain-based decentralized federated learning: A secure and privacy-preserving system
Zhao, S., Wu, Y., Sun, R., Qian, X., Zi, D., Xie, Z., Tong, E., Niu, W., Liu, J., & Han, Z. (2021) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys53884.2021.00150 · Cited by 12
An Empirical Evaluation of the Data Leakage in Federated Graph Learning
Chen, J., Ma, M., Ma, H., Zheng, H., & Zhang, J. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3326359 · Cited by 16
“For instance, Zhang et al. [39] launched an attack on honest participants in federated learning by using privacy inference attacks in a black-box environment to obtain sensitive records in training data.”
BackgroundSelf-citationFu, X., Xiong, L., Li, F., Yang, X., & Xiong, N. N. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3439437 · Cited by 11
“For example, an attack method using Generative Adversarial Networks (GANs) was proposed in [13] that strengthens the membership privacy attack further exposing the participants’ privacy by performing active, collaboration-free attacks on the local model.”
Amiri, S., Belloum, A. S. Z., Nalisnick, E., Klous, S., & Gommans, L. (2022) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w54100.2022.00018 · Cited by 13
“However, it has been shown that FL by itself does not guarantee privacy and has been known to be vulnerable to different adversarial attacks such as Membership Inference Attacks [2], [3], Reconstruction Attacks [4], [5] and Inversion Attacks [6], [7].”
Defending against Membership Inference Attacks in Federated learning via Adversarial Example
Xie, Y., Chen, B., Zhang, J., & Wu, D. (2021) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn53354.2021.00036 · Cited by 11
Self-citationSandeepa, C., Siniarski, B., Wang, S., & Liyanage, M. (2023) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2023.3333560 · Cited by 11
“A Generative Adversarial Network (GAN)-based membership inference attack on FL is proposed in [3].”
BackgroundMethodResultInfluentialGenerative Image Reconstruction From Gradients
Sotthiwat, E., Zhen, L., Zhang, C., Li, Z., & Goh, R. S. M. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2024.3383722 · Cited by 13
“For the first types of leakage information, the membership inference attacks [2], [3], [18], [19] are able to distinguish whether the selected data is or is not trained in the centralized FL.”
A Secure Object Detection Technique for Intelligent Transportation Systems
Mia, M. J., & Amini, M. H. (2024) · IEEE Open Journal of Intelligent Transportation Systems · doi:10.1109/ojits.2024.3440876 · Cited by 11
“In inference attacks, an attacker can deduce confidential information by analyzing the global model or from the communication channel [24], [25].”
BackgroundDGGI: Deep Generative Gradient Inversion with diffusion model
Wu, L., Liu, Z., Pu, B., Wei, K., Cao, H., & Yao, S. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102620 · Cited by 14
Enhancing Cybersecurity in smart grid: a review of machine learning approaches
Hamdi, N. (2025) · Telecommunication Systems · doi:10.1007/s11235-025-01308-9 · Cited by 10
Naseri, M., Han, Y., Mariconti, E., Shen, Y. C., Stringhini, G., & Cristofaro, E. D. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560580 · Cited by 13
Wang, N., Xiao, Y., Chen, Y., Zhang, N., Lou, W., & Hou, Y. T. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3564652 · Cited by 9
“Further, an adversary [19, 32] can differentiate whether one data record is in the training dataset or not by accessing only the model.”
BackgroundSubject-Level Membership Inference Attack via Data Augmentation and Model Discrepancy
Liu, Y., Jiang, P., & Zhu, L. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3318950 · Cited by 10
“• Prior Dataset: Similar to the previous MIAs [22], [23], [24], we assume that the adversary possesses a limited prior dataset, which pertains to their curious federated users.”
BackgroundMethodALGANs: Enhancing membership inference attacks in federated learning with GANs and active learning
Xie, Y., Chen, B., Zhang, J., & Li, W. (2022) · IEEE International Symposium on Product Compliance Engineering - Asia (ISPCE-ASIA) · doi:10.1109/ispce-asia57917.2022.9971068 · Cited by 9
“However, the lack of attack data is still a challenge that makes the attack less successful [4].”
BackgroundMethodResultInfluentialSelf-citationTowards Privacy-Preserving Federated Neuromorphic Learning via Spiking Neuron Models
Han, B., Fu, Q., & Zhang, X. (2023) · Electronics · doi:10.3390/electronics12183984 · Cited by 9
Privacy of the Metaverse: Current Issues, AI Attacks, and Possible Solutions
Sandeepa, C., Wang, S., & Liyanage, M. (2023) · IEEE International Conference on Metaverse Computing, Networking and Applications (MetaCom) · doi:10.1109/metacom57706.2023.00052 · Cited by 11
“These representative data records can be generated using generative models such as Generative Adversarial Networks (GAN) [46].”
MethodFederated Analytics With Data Augmentation in Domain Generalization Toward Future Networks
Zhang, X., Parra-Ullauri, J. M., Moazzeni, S., Vasilakos, X., Nejabati, R., & Simeonidou, D. E. (2024) · IEEE Transactions on Machine Learning in Communications and Networking · doi:10.1109/tmlcn.2024.3393892 · Cited by 9
“The work in [44] uses GANs to enrich attack data.”
MethodSniper Backdoor: Single Client Targeted Backdoor Attack in Federated Learning
Abad, G., Paguada, S., Ersoy, O., Picek, S., Ramírez-Durán, V. J., & Urbieta, A. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00033 · Cited by 13
“Concerning security, GANs have also played an important role, performing inference attacks [53] or generating adversarial examples [49].”
BackgroundZhao, H., Pan, C., Liu, M., Jiao, D., & Zhu, H. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3568030 · Cited by 9
“Current privacy threats have encompassed membership inference attacks [16], attribute inference attacks [17], [18], GANs inference attacks [19], and reconstruction inference attacks [20], [21].”
GBMIA: Gradient-based Membership Inference Attack in Federated Learning
Wang, X., Wang, N., Wu, L., Guan, Z., Du, X., & Guizani, M. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10279702 · Cited by 8
“Zhang et al. [9] utilized generative adversarial networks to produce and enrich the attack model’s training data, but it does not reduce the overhead and complexity of the attack model-based MIAs.”
BackgroundMarking the Pace: A Blockchain-Enhanced Privacy-Traceable Strategy for Federated Recommender Systems
Cai, Z., Tang, T., Yu, S., Xiao, Y., & Xia, F. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3329363 · Cited by 9
“Therefore, lacking traceability, the recommendation process could suffer malicious manipulation [36], [37], [38], further posing trust-related risks [39], [40].”
BackgroundSelf-citationKaushal, V., & Sharma, S. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02339-z · Cited by 9
“…of attacks can be launched against federated learning systems [7], including data poisoning attacks [8], model poisoning attacks [9], backdoor attacks [10], Byzantine attacks [11], membership inference attacks [12], model inversion attacks [13], Sybil attacks [14], and eavesdropping attacks [15].”
Xiao, Y., Zhao, D., Li, X., Li, T., Wang, R., & Wang, G. (2025) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2025.3553501 · Cited by 9
“Theirlinesofresearchincludedataaug-mentationmethodsunderfederatedlearning[14],[15],[16], [17],mitigateheterogeneityforwidelyvaryingmulti-source data[18],[19],[20],encryptingtheoriginaldatawithencryption computationanddesigningdifferentdifferentialprivacymech-anisms[21],[22].”
From Opacity to Clarity: Leveraging XAI for Robust Network Traffic Classification
Sandeepa, C., Senevirathna, T., Siniarski, B., Nguyen, M.-D., La, V.-H., Wang, S., & Liyanage, M. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-51135-6_11 · Cited by 7
Federated Learning With Heterogeneous Client Expectations: A Game Theory Approach
Shen, S., Liu, C., & Lim, T. J. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3464488 · Cited by 6
“Second, FL has been proven to be vulnerable to some attacks such as model inversion attacks [8], [9] and membership inference attacks [10], [11], [12], [13] which result in data privacy leakage.”
BackgroundSecuring Federated Learning in IoT: A Survey of Attacks, Defenses, and Frameworks
Atia, O. B., Samara, M. A., Bennis, I., Gaber, J., Abouaïssa, A., & Lorenz, P. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3600617 · Cited by 6
“Techniques, such as the one proposed by [56] demonstrate the nuanced approach required to successfully execute membership attacks, underscoring the sophisticated nature of threats facing FL environments.”
Aziz, R., Banerjee, S., & Bouzefrane, S. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-60391-4_11 · Cited by 6
Li, H., & Huang, J. (2024) · Vehicular Communications · doi:10.1016/j.vehcom.2024.100853 · Cited by 6
Black-Box Based Limited Query Membership Inference Attack
Zhang, Y., Zhou, H., Wang, P., & Yang, G. (2022) · IEEE Access · doi:10.1109/access.2022.3175824 · Cited by 6
“Based on this, Marza et al.[23] proposed the CGAN model, which is an effective improvement on the original GAN.”
BackgroundMethodFabricated Flips: Poisoning Federated Learning without Data
Huang, J., Zhao, Z., Chen, L. Y., & Roos, S. (2023) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58367.2023.00036 · Cited by 6
“Our attack uses a generator, as do other attacks but for highly different scenarios or goals: attacking centralized learning [51, 54], attacking privacy [36, 55], or mimicking prototypical samples of the other participants’ training set with the goal of targeted attacks [52, 53].”
BackgroundRobust and privacy-preserving collaborative training: a comprehensive survey
Yang, F., Zhang, X., Guo, S., Chen, D., Gan, Y., Xiang, T., & Liu, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10797-0 · Cited by 17
FDP-FL: differentially private federated learning with flexible privacy budget allocation
Wenjun, Q., Shen, Q., Chen, X., Li, C., Fang, Y., & Wu, Z. (2024) · The Computer Journal · doi:10.1093/comjnl/bxae081 · Cited by 5
Qin, X. R., Yang, X. S., & Tang, X. (2025) · Pattern Recognition · doi:10.1016/j.patcog.2025.112174 · Cited by 5
Feng, S., Mohammady, M., Hong, H., Yan, S., Kundu, A., Wang, B., & Hong, Y. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726517 · Cited by 8
Investigated Insider and Outsider Attacks on the Federated Learning Systems
Ahmed, I. M., & Kashmoola, M. Y. (2022) · IEEE International Conference on Communication, Networks and Satellite (COMNETSAT) · doi:10.1109/comnetsat56033.2022.9994330 · Cited by 6
“Jingwen Zhang et al. [14], Federated Learning is susceptible to a major privacy breach due to a method of attack using membership inference.”
BackgroundMethodInfluentialMishra, K. N., Bhattacharjee, V., Saket, S., & Mishra, S. P. (2022) · Research Square · doi:10.21203/rs.3.rs-1714576/v1 · Cited by 5
Haghbin, Y., Badiei, M. H., Tran, N. H. K., & Piran, M. J. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3571688 · Cited by 4
“Beyond their defensive applications, GANs’ ability to generate enriched and diverse synthetic data sometimes benefits the adversary, where using synthetic data within training can strengthen some attacks and challenge privacy in FL [44], [45].”
Zuo, C., Xu, P., Song, Y., Lu, J., Yuan, C., & Li, Y. (2025) · Scientific Reports · doi:10.1038/s41598-025-16830-8 · Cited by 4
Efficient Byzantine-Robust Privacy-Preserving Federated Learning via Dimension Compression
Qin, X. R., Yang, X. S., & Tang, X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3671104 · Cited by 5
“Research [5], [6], [7] indicates that model updates can leak sensitive information about local data, even without direct data sharing.”
Campus Network Intrusion Detection based on Federated Learning
Chen, J., Guo, Q., Fu, Z., Shang, Q., Ma, H., & Wu, D. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892843 · Cited by 4
“…Settings: Although federated learning can protect data privacy of participants by only uploading local model parameters, it still faces challenges such as Data Reconstruction Attacks [18], Membership-Inference Attacks [19], Model Inversion Attacks [20], Poisoning Attacks [21], and other threats.”
BackgroundSelf-citationA Privacy-Enhancing Mechanism for Federated Graph Neural Networks
Tang, X., & Hu, F. (2025) · Symmetry · doi:10.3390/sym17040565 · Cited by 4
Personalized Differential Privacy Federated Learning Model for Internet of Vehicles
Zhang, L., Zuo, J., Lu, Y., & Zou, S. (2024) · IEEE Smart World Congress (SWC) · doi:10.1109/swc62898.2024.00349 · Cited by 2
“Li et al. [16] measure the degree of privacy leakage in federated learning using gradient leakage attacks, while Zhang et al. [17] analyze the privacy leakage risks revealed by membership inference attacks.”
Liu, G., Xu, T., Yang, Y., Abdelmoniem, A. M., Wang, C., & Liu, J. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3564697 · Cited by 2
“Considering the difficulty to acquire a training set with the same distribution as the target model, Zhang et al. [42] use generative adversarial networks to generate the training data of the target client, making the attack possible under the iid condition.”
CGGL: A client-side generative gradient leakage attack with double diffusion prior
Pu, B., Liu, Z., Wu, L., Xu, K., Liang, B., He, Z., Ma, B., & Zhao, L. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103292 · Cited by 3
Towards efficient and secure vertical federated learning with additive ensemble
Wang, S., Chen, Z., Liu, L., & Xu, W. (2026) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-025-02897-2 · Cited by 2
“We validated our method by performing classification and regression tasks on multiple datasets, and demonstrated that our method can greatly improve model accuracy in bothtypesoftasks,whileeffectivelyalleviatingthemost common attack in VFL - label inference attack [25, 38].”
Metadata
- Authors
- Zhang, J., Zhang, J., Chen, J., & Yu, S.
- Affiliations
- University of Technology Sydney (AU)
- Beijing University of Chemical Technology (CN)
- Venue
- ICC 2020 - 2020 IEEE International Conference on Communications (ICC)
- Publisher
- IEEE
- Published
- 2020-06
- Pages
- 1-6
- ISSN
- 1550-3607 (ISSN-L)
- OpenAlex
- W3045720734
- Cited by
- 133
- References
- 25
- Citations by year
- 2026: 5 · 2025: 29 · 2024: 39 · 2023: 26 · 2022: 25 · 2021: 9
- FWCI
- 5.72
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- International Conference on Communications (publishedVersion)
- OPUS - Open Publications of UTS Scholars (University of Technology Sydney) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, federated learning, generative adversarial networks, privacy leakage, data diversity, overfitting, federated learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
