The DOI matches its Crossref record; 25 of the 25 references it cites were found in a registry or an index.
GAN Enhanced Membership Inference: A Passive Local Attack in Federated Learning
Abstract
Federated learning has lately received great attention for its privacy protection feature. However, recent researches found that federated learning models are susceptible to various inference attacks. In this paper, we point out a membership inference attack method that can cause a serious privacy leakage in federated learning. An adversary who is a participant in federated learning can train a classification attack model to launch the membership inference attack, which determines if a data record is in the model's training dataset. The existing membership inference method is dissatisfied due to a lack of attack data since the training data of each participant are independent. To overcome the lack of attack data, an adversary can enrich attack data using the generative adversarial network (GAN), which is a practical method to increase data diversity. We substantiate that this GAN enhanced membership inference attack method has a 98% attack accuracy. We perform experiments to show that data diversity and the overfitting make federated learning models susceptible.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“The fake parameter update from an adversary is also a security bottleneck [81] which can impersonate a certain client and broadcast fake parameters.”
From Federated learning meets blockchain in edge computing: Opportunities and challenges (2021) · cites this paper as [81]
Citations
Cites
Labaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Conditional Generative Adversarial Nets
Mirza, M., & Osindero, S. (2014) · arXiv · doi:10.48550/arxiv.1411.1784 · Cited by 8,863
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
Hitaj, B., Ateniese, G., & Perez-Cruz, F. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134012 · Cited by 1,377
Cited by
Sorted by citations
Items 101–133 of 133
Jin, Y., Zhu, H., Xu, J., & Chen, Y. (2022) · Machine learning · doi:10.1007/978-981-19-7083-2_4 · Cited by 2
FL-TIA: Novel Time Inference Attacks on Federated Learning
Sandeepa, C., Siniarski, B., Wang, S., & Liyanage, M. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00044 · Cited by 2
“None of the previous works of the current state-of-the-art, such as [9], [10], considered the factor of accuracy loss over iterations.”
BackgroundMethodResultInfluentialLRPAFL: Layer-Wise Relevance Propagation-Based Adaptive Federated Learning
Wang, S., Fang, Z., & Gai, K. (2024) · IEEE International Conference on Cyber Security and Cloud Computing (CSCloud) · doi:10.1109/cscloud62866.2024.00038 · Cited by 2
“However, the privacy aspects of FL still face challenges, as attackers may be able to infer partial information about a client’s local original data based on the model [16], [17].”
BackgroundPIAFGNN: Property Inference Attacks against Federated Graph Neural Networks
Liu, J., Xue, B., Guo, M., Xu, Y., & Chen, B. (2024) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2024.057814 · Cited by 2
Xia, F., Liu, Y., Jin, B., Yu, Z., Cai, X., Li, H., Zha, Z., Hou, D., & Peng, K. (2024) · Symmetry · doi:10.3390/sym16121677 · Cited by 2
Toward Efficient Federated Load Forecasting: Personalization Mechanisms and Their Impact
Dissem, M., & Amayri, M. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3580378 · Cited by 2
“Notably, privacy attacks, such as membership inference [64], where adversaries determine whether a specific sample was part of a client’s local training data, undermine the very notion of data confidentiality FL aims to preserve.”
Vo, H. K., Tang, M., Zheng, X., & Yu, S. (2022) · Mobility in the Evolving Internet Architecture · doi:10.1145/3556548.3559636 · Cited by 2
“In [16], the authors use GAN to generate fake samples that have similar distribution as the original dataset.”
MethodResultSelf-citationReducing Model Memorization to Mitigate Membership Inference Attacks
Sheikhjaberi, M., & Alhadidi, D. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00033 · Cited by 1
“The membership inference attack can target other settings, e.g., federated learning [20]–[22] or Generative Adversarial Networks (GANs) models [23]–[26], and it is not limited to centralized models.”
BackgroundTowards Secure Federated Learning: Enhancing Privacy and Robustness in Decentralized AI Systems
Louis, R., Bakir, N., Samrouth, K., & Pak, V. (2024) · International Conference on Computer and Applications (ICCA) · doi:10.1109/icca62237.2024.10928052 · Cited by 2
“Our goal is to contribute to the growing body of research on securing Federated Learning systems, the primary objectives of this research are: Zhang et al. proposed a novel GAN-based method for membership inference attacks in federated learning and obtained a high accuracy [11].”
DECML: Distributed Edge Consensus Machine Learning Framework
Verdeyen, C., Shepherd, C., Markantonakis, K., Akram, R. N., Milroy, R., Ghazalah, S. A., & Sauveron, D. (2024) · IEEE Global Conference on Artificial Intelligence and Internet of Things (GCAIoT) · doi:10.1109/gcaiot63427.2024.10833588 · Cited by 1
“Unlike FL, where model updates can still leak sensitive information through inference attacks [24], [25], DECML focuses on a consensus-based decision-making process that reduces exposure to such risks.”
Chen, Q., & Tao, Y. (2025) · Cluster Computing · doi:10.1007/s10586-024-04974-7 · Cited by 1
FedRE: Robust and Effective Federated Learning with Privacy Preference
Xiao, T., Li, Y., Zhou, Y., Qi, Y., Liu, Y., Wang, W., Wang, H., Wang, Y., & Li, R. (2025) · International Conference on Multimedia Retrieval · doi:10.1145/3731715.3733336 · Cited by 1
Zhao, S., Fu, X., Liu, L., Li, J., Peng, W., & Ding, J. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07616-w · Cited by 1
Liu, L., Chen, J., Fan, H., Xu, K., Zhang, P., Li, X., & Xiang, T. (2025) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2025.3645450 · Cited by 1
“Attacks have evolved from GAN-based record recovery [27] to passive feature leakage [28], user-level tracing [29], high-accuracy confidence-series probes [30], [31], sequential-round inference [32], [33], and over-parameterization-assisted passive monitoring [34].”
Self-citationFederated adaptive pruning with differential privacy
Wang, Z., Shen, J., Dai, H., Xu, J., Yang, G., & Zhou, H. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.107783 · Cited by 1
MOFDRNet : A Model for Data Leakage Attacks in Federated Learning
Zhao, Y., Zhang, J., Cao, Y., & Han, X. (2025) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.70032 · Cited by 1
Self-citationSurvey of Privacy Threats and Countermeasures in Federated Learning
Hayashitani, M., Mori, J., & Teranishi, I. (2025) · International Conference on Federated Learning Technologies and Applications (FLTA) · doi:10.1109/flta67013.2025.11336767 · Cited by 1
“Two widely used general approaches in privacy-preserving FL are: (1) Communication channel defenses, which employ cryptographic techniques to protect model parameters or gradients and (2) Differential privacy (DP), which prevents the leakage of data records from the model.”
GAN Attacks and Counterattacks in Federated Learning
Yu, S., & Cui, L. (2022) · Digital Privacy and Security · doi:10.1007/978-981-19-8692-5_4
Self-citationWalker, E., Bu, J., Pakseresht, M., Wickham, M. E., Shack, L., Robson, P. J., & Hegde, N. (2023) · Research Square · doi:10.21203/rs.3.rs-3393386/v1
Federated Learning for IoT Applications, Attacks and Defense Methods
Qu, Z., Duan, R., Liu, Y., & Lu, Z. (2023) · Springer eBooks · doi:10.1007/978-3-031-42637-7_9
Optimization Scheme for Privacy Protection on Cloud Platforms Based on Data Classification
Gong, S., Ling, D. X., Bo, Y. D., Lu, W. H., Chuang, W. Z., & Tao, J. (2024) · IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC) · doi:10.1109/iaeac59436.2024.10503921
The Cost of Privacy: A Comprehensive Analysis of the Security Issues in Federated Learning
Sundar, A. P., Li, F., Zou, X., & Gao, T. (2024) · Advances in information security · doi:10.1007/978-3-031-53510-9_14
Anti-AsynDGAN: Black-box Membership Inference Attacks Against Medical Distributed Generation Models
Chen, Y., Pang, S., & Zhang, R. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10650633
EdgeFedNet: Edge Server Based Communication and Computation Efficient Federated Learning
Gowtham, L., Annappa, B., & Sachin, D. N. (2025) · SN Computer Science · doi:10.1007/s42979-025-03789-6
Subject Data Auditing via Source Inference Attack in Cross-Silo Federated Learning
Li, J., Arazzi, M., Nocera, A., & Conti, M. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104034 · Cited by 3
Federated Learning: An Overview of Attacks and Defense Methods
Sameera, K. M., Arikkat, D. R., Vinod, P., A., R. R. K., Aneez, A., & Conti, M. (2025) · Springer eBooks · doi:10.1007/978-3-031-83157-7_14
PDLG: Prevent Deep Leakage from Gradients based on Dataset Condensation in Federated Meta-Learning
Zhang, Y., Bian, W., Wu, F., Cui, L., Sun, S., & Gao, L. (2024) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn63567.2024.00076
Optimization of VGG-16 Model Using Stripe-Wise Pruning in a Federated Environment
Hallad, S. S., Nadaf, S. M., Shetty, P., Bafna, A., Habib, K. V., Meena, S. M., & Kulkarni, U. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-96-3652-5_5
A Data Privacy Risk Assessment Model for Federated Learning in the Internet of Vehicles
Zuo, J., Zhang, L., Xie, W., Lu, Y., & Wen, X. (2026) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2026.3665794
“Zhang et al. [16] proposed an affiliation inference attack method that induces severe privacy leakage in FL systems.”
Privacy preserving location based services : From centralized to federated approaches
Khalfoun, B. (2022) · theses.fr (ABES) · doi:10.70675/c118af96z9a87z460fz8378zb039b96ece7d
Secure collaborative management platform applied to IoT Networks
Atia, O. B. (2024) · theses.fr (ABES) · doi:10.70675/6c43d453z9fb0z4a37z8123z35304e4a31cc
A Data-Free Membership Inference Attack on Federated Learning in Hardware Assurance
Lee, G., Bowman, W., Dizon-Paradis, O. P., Dizon-Paradis, R. N., Wilson, R., Woodard, D. L., & Forte, D. J. (2026) · International Symposium on Quality Electronic Design (ISQED) · doi:10.1109/isqed69900.2026.11534734
Zhong, H., Sani, N. F. M., Hamdan, H., Kasmiran, K. A., Zhang, X., Yang, S., & Hassan, Z. L. (2026) · The Journal of Supercomputing · doi:10.1007/s11227-026-08929-0
Metadata
- Authors
- Zhang, J., Zhang, J., Chen, J., & Yu, S.
- Affiliations
- University of Technology Sydney (AU)
- Beijing University of Chemical Technology (CN)
- Venue
- ICC 2020 - 2020 IEEE International Conference on Communications (ICC)
- Publisher
- IEEE
- Published
- 2020-06
- Pages
- 1-6
- ISSN
- 1550-3607 (ISSN-L)
- OpenAlex
- W3045720734
- Cited by
- 133
- References
- 25
- Citations by year
- 2026: 5 · 2025: 29 · 2024: 39 · 2023: 26 · 2022: 25 · 2021: 9
- FWCI
- 5.72
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- International Conference on Communications (publishedVersion)
- OPUS - Open Publications of UTS Scholars (University of Technology Sydney) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- membership inference attacks, federated learning, generative adversarial networks, privacy leakage, data diversity, overfitting, federated learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
