The DOI matches its Crossref record; 42 of the 42 references it cites were found in a registry or an index.
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations
Open accessAbstract
With the growing adoption of machine learning, sharing of learned models is becoming popular. However, in addition to the prediction properties the model producer aims to share, there is also a risk that the model consumer can infer other properties of the training data the model producer did not intend to share. In this paper, we focus on the inference of global properties of the training data, such as the environment in which the data was produced, or the fraction of the data that comes from a certain class, as applied to white-box Fully Connected Neural Networks (FCNNs). Because of their complexity and inscrutability, FCNNs have a particularly high risk of leaking unexpected information about their training sets; at the same time, this complexity makes extracting this information challenging. We develop techniques that reduce this complexity by noting that FCNNs are invariant under permutation of nodes in each layer. We develop our techniques using representations that capture this invariance and simplify the information extraction task. We evaluate our techniques on several synthetic and standard benchmark datasets and show that they are very effective at inferring various data properties. We also perform two case studies to demonstrate the impact of our attack. In the first case study we show that a classifier that recognizes smiling faces also leaks information about the relative attractiveness of the individuals in its training set. In the second case study we show that a classifier that recognizes Bitcoin mining from performance counters also leaks information about whether the classifier was trained on logs from machines that were patched for the Meltdown and Spectre attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In order to better capture the level of confidence of the model, one may also sort the posteriors before the difference or concatenation operations [20].”
From When Machine Unlearning Jeopardizes Privacy (2021) · cites this paper as [20]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946
Semi-supervised classification with graph convolutional networks
Kipf, T. N., & Welling, M. (2016) · arXiv · doi:10.48550/arxiv.1609.02907 · Cited by 24,853
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280
A Stochastic Approximation Method
Robbins, H., & Monro, S. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729586 · Cited by 9,643
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
(2018) · Cited by 3,510
Flagged first, then by citations
Research works printed but not linked: 9
- Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from Amazon. 2018. Machine Learning at AWS. https://aws.amazon.com/machine-learning/ Retrieved August 15, 2018 from
- BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from BigML Inc. 2018. BigML. https://bigml.com/ Retrieved August 15, 2018 from
- Eric Florenzano . 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from Eric Florenzano. 2016. Gadientzoo. https://www.gradientzoo.com/ Retrieved August 15, 2018 from
- Google Cloud . 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from Google Cloud. 2018. Cloud Machine Learning Engine. https://cloud.google.com/ml-engine/ Retrieved August 15, 2018 from
- Jamie Hayes , Luca Melis , George Danezis , and Emiliano De Cristofaro . 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 ( 2017 ). Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663 (2017). · arXiv
- Zhiqiang Lin , Xiangyu Zhang , and Dongyan Xu . 2010 . Automatic reverse engineering of data structures from binary execution . In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5. Zhiqiang Lin, Xiangyu Zhang, and Dongyan Xu. 2010. Automatic reverse engineering of data structures from binary execution. In Proceedings of the 11th Annual Information Security Symposium. CERIAS-Purdue University, 5.
- PyTorch core team. 2018. Pytorch . http://pytorch.org/ Retrieved August 15, 2018 from PyTorch core team. 2018. Pytorch. http://pytorch.org/ Retrieved August 15, 2018 from
- Perf Wiki . 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from Perf Wiki. 2018. Linux profiling with performance counters. https://perf.wiki.kernel.org/index.php/Main_Page Retrieved August 15, 2018 from
- Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404. Manzil Zaheer Satwik Kottur Siamak Ravanbakhsh Barnabas Poczos Ruslan R Salakhutdinov and Alexander J Smola. 2017. Deep sets. In Advances in Neural Information Processing Systems. 3394--3404.
Cited by
Sorted by citations
Items 101–200 of 471
SoK: Model Inversion Attack Landscape: Taxonomy, Challenges, and Future Roadmap
Dibbo, S. V. (2023) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf57540.2023.00027 · Cited by 58
“on inference attack objective: Attribute Inference (AI) to infer exactly an individual’s sensitive attribute values using output labels and other information like confidence scores and information about non-sensitive attributes (tabular data), depending on the attack strategy [23], [33], [36], whereas Approximate Attr…”
BackgroundMIRROR: Model Inversion for Deep Learning Network with High Fidelity
An, S., Tao, G., Xu, Q., Liu, Y., Shen, G., Yao, Y., Xu, J., & Zhang, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24335 · Cited by 48
“[24] proposed property inference attacks that extract data properties of the training data (e.”
BackgroundEnhanced Security and Privacy via Fragmented Federated Learning
Jebreel, N., Domingo‐Ferrer, J., Blanco-Justicia, A., & Sánchez, D. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3212627 · Cited by 50
“Property inference attacks try to infer specific properties about the training data [13], [50].”
BackgroundMoore, E., Imteaj, A., Rezapour, S., & Amini, M. H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3313055 · Cited by 52
“For example, Ganju et al. [45] demonstrated that a classifier that recognizes smiling faces also leaks information about the relative attractiveness of the individuals in its training set [45].”
BackgroundA comprehensive review on deep learning algorithms: Security and privacy issues
Tayyab, M. A., Marjani, M., Jhanjhi, N. Z., Hashem, M., Usmani, R. S. A., & Qamar, F. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103297 · Cited by 50
Does Differential Privacy Really Protect Federated Learning From Gradient Leakage Attacks?
Hu, J., Du, J., Wang, Z., Pang, X., Zhou, Y., Sun, P., & Ren, K. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3417930 · Cited by 49
“For example, an attacker can launch membership inference attacks [2], [3], [4], [5], property inference attacks [6], [7], [8] and data reconstruction attacks [9], [10], [11], [12] to infer sensitive information of training data.”
BackgroundDifferentially Private Graph Neural Networks for Whole-Graph Classification
Mueller, T. T., Paetzold, J. C., Prabhakar, C., Usynin, D., Rueckert, D., & Kaissis, G. A. (2022) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3228315 · Cited by 53
“Various machine learning contexts have been shown vulnerable to be exploited by malicious actors, resulting in a leakage of private attributes [10], of membership information [11] or even in full dataset reconstruction [12], [13].”
BackgroundGIFD: A Generative Gradient Inversion Method with Feature Domain Optimization
Fang, H., Chen, B., Wang, X., Wang, Z., & Xia, S. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00458 · Cited by 46
“A similar attack, called property inference [8], can reveal the attributes of the samples in the training set.”
BackgroundA survey on privacy inference attacks and defenses in cloud-based Deep Neural Network
Zhang, X., Chen, C., Xie, Y., Chen, X., Zhang, J., & Xiang, Y. (2022) · Computer Standards & Interfaces · doi:10.1016/j.csi.2022.103672 · Cited by 53
Source Inference Attacks: Beyond Membership Inference Attacks in Federated Learning
Hu, H., Zhang, X., Salcic, Z. A., Sun, L., Choo, K. R., & Dobbie, G. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3321565 · Cited by 47
“…private training data, there are several recently proposed privacy attacks trying to infer the privacy of the clients from such updates, such as data reconstruction attacks [14], property inference attacks [15], preference profiling attacks [13], and membership inference attacks (MIAs) [16].”
BackgroundA review on client-server attacks and defenses in federated learning
Sharma, A., & Marchang, N. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103801 · Cited by 46
Security for Machine Learning-based Software Systems: A Survey of Threats, Practices, and Challenges
Chen, H., & Babar, M. A. (2023) · ACM Computing Surveys · doi:10.1145/3638531 · Cited by 66
“In following sections, we discuss the security threats of MLBSS from the system aspects of confidentiality, integrity and availability.”
BackgroundLiu, C., Chen, B., Shao, W., Zhang, W., Wong, K. K. L., & Zhang, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3377730 · Cited by 45
“Ganju et al. [111] took advantage of the fact that fully connected neural networks (FCNNs) is invariant under the arrangement of nodes in each layer to simplify the information extraction task, and put forward a feasible defense strategy for this attack, such as using node multiplicative…”
BackgroundA survey of secure semantic communications
Meng, R., Gao, S., Fan, D., Gao, H., Wang, Y., Xu, X., Wang, B., Lv, S., Zhang, Z., Sun, M., et al. (2025) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2025.104181 · Cited by 52
Dataset Inference: Ownership Resolution in Machine LearningPreprint
Maini, P., Yaghini, M., & Papernot, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.10706 · Cited by 87
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38
“Considering that fully connected neural networks (FCNNs) are invariant under the permutation of nodes when represented using matrices, study [69] introduces PIAs in white box settings and shows good inference performance in shallow FCNNs.”
SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning
Salem, A., Cherubin, G., Evans, D. M., Köpf, B., Paverd, A., Suri, A., Tople, S., & Zanella-Béguelin, S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179281 · Cited by 44
“[22] in the whitebox setting and by Zhang et al.”
BackgroundMethodDefense against neural trojan attacks: A survey
Kaviani, S., & Sohn, I. (2020) · Neurocomputing · doi:10.1016/j.neucom.2020.07.133 · Cited by 39
Stealing Deep Reinforcement Learning Models for Fun and Profit
Chen, K., Guo, S., Zhang, T., Xie, X., & Liu, Y. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453090 · Cited by 44
“A quantity of works have been done to disclose the privacy threats about the training data [16, 20, 21] or models [42, 53, 55, 62] in the deep learning development pipeline.”
BackgroundStealing Machine Learning Models: Attacks and Countermeasures for Generative Adversarial Networks
Hu, H., & Pang, J. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485838 · Cited by 54
“In addition to model extraction attacks, there are other types of attacks in relation to privacy and security [10, 22, 68, 70], such as membership inference attacks [13, 20, 56, 59, 60] and property inference attacks [18].”
BackgroundMitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble ArchitecturePreprint
Tang, X., Mahloujifar, S., Song, L., Shejwalkar, V., Nasr, M., Houmansadr, A., & Mittal, P. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08324 · Cited by 43
“Recent work has shown that machine learning models are prone to memorizing sensitive information of training data incurring serious privacy risks [3,4,12,13,40,43,45].”
BackgroundPPA: Preference Profiling Attack Against Federated Learning
Zhou, C., Gao, Y., Fu, A., Chen, K., Dai, Z., Zhang, Z., Xue, M., & Zhang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23171 · Cited by 41
“A property inference attack [13], [32] infers whether a target attribute exists in a victim user’s local dataset.”
BackgroundInfluentialGroup Property Inference Attacks Against Graph Neural Networks
Wang, X., & Wang, H. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560662 · Cited by 43
“In the following years, the design of PIA has been extended to fully connected neural networks [19], Convolutional Neural Networks (CNNs) [35], collaborative learning [32], federated learning [43, 44], and GANs [53].”
InfluentialCrowdGuard: Federated Backdoor Detection in Federated Learning
Rieger, P., Krauß, T., Miettinen, M., Dmitrienko, A., & Sadeghi, A.-R. (2024) · Proceedings 2024 Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23233 · Cited by 36
“…clients from an enclave and then perform a ▷ Aggregate result 24: significant ← mean significant OR var significant OR dist significant OR outlier quartil significant OR outlier sigma significant model inference attack [29], [36], [52], [63], [71], [76], [82], [88], [95] on the extracted models.”
BackgroundLederer, I., Mayer, R. L., & Rauber, A. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2023.3270135 · Cited by 35
“[37] showed that regularizer-based watermarking schemes are vulnerable to watermark detection through the use of a property inference attack [90].”
BackgroundBarnawi, A., Chhikara, P., Tekchandani, R., Kumar, N., & Alzahrani, B. A. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3393969 · Cited by 37
“This can lead to adversaries utilizing the information to develop identical models or even having security issues when the learned knowledge can be used to detect susceptibilities of a system [51].”
BackgroundAttribute Privacy: Framework and Mechanisms
Zhang, W., Ohrimenko, O., & Cummings, R. (2022) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3531146.3533139 · Cited by 35
“Attribute (or feature) privacy attacks, on the other hand, consider leakage of attribute values at an individual level [9, 23], and property inference attacks show that global properties about datasets can be leaked [1, 10, 20].”
BackgroundSPEI-FL: Serverless Privacy Edge Intelligence-Enabled Federated Learning in Smart Healthcare Systems
Akter, M., Moustafa, N., & Turnbull, B. (2024) · Cognitive Computation · doi:10.1007/s12559-024-10310-3 · Cited by 35
“Recent studies [25, 26] have shown that only the transmission gradient is susceptible to different attack levels.”
Formalizing and Estimating Distribution Inference Risks
Suri, A., & Evans, D. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0121 · Cited by 35
“take several forms: using model weights themselves with permutation-invariance [9], or model activations or logits for a static/dynamically-generated set of query points [10].”
BackgroundMethodInfluentialLabel-Leaks: Membership Inference Attack with Label.Preprint
Li, Z., & Yan, S. (2020) · arXiv (Cornell University) · Cited by 34
DeepTheft: Stealing DNN Model Architectures through Power Side Channel
Gao, Y., Qiu, H., Zhang, Z., Wang, B., Ma, H., Abuadbba, A., Xue, M., Fu, A., & Nepal, . (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00250 · Cited by 35
“Additionally, a known DNN architecture can also be a premise to take further attacks such as model weights stealing [32], model hyperparameter stealing [44], membership inference [8], [38], property inference [14], and data reconstruction [6], [13].”
BackgroundPrivacy-preserving explainable AI: a survey
Nguyên, T. T., Huynh, T. T., Ren, Z., Nguyen, T. T., Nguyen, P. L., Yin, H., & Nguyen, Q. V. H. (2024) · Science China Information Sciences · doi:10.1007/s11432-024-4123-4 · Cited by 58
“These types of attacks are distinct from property inference attacks, which seek to ascertain broader dataset characteristics, like the training data’s gender ratio [121–123].”
Security of federated learning for cloud‐edge intelligence collaborative computing
Yang, J., Zheng, J., Zhang, Z., Chen, Q., Wong, D. S., & Li, Y. (2022) · International Journal of Intelligent Systems · doi:10.1002/int.22992 · Cited by 32
“Ganju et al. 36 proposed a properties inference attack against a fully connected, relatively shallow neural network.”
BackgroundSecurity and Privacy Issues in Deep Reinforcement Learning: Threats and Countermeasures
Mo, K., Ye, P.-G., Ren, X., Wang, S., Li, W., & Li, J. (2024) · ACM Computing Surveys · doi:10.1145/3640312 · Cited by 37
“In order to infer global properties of the training datasets, Ganju et al. [35] irst proposed a property inference attack method for fully connected neural networks (FCNNs), which simpliies the training process of property inference attack based on meta classiier [6].”
MethodAI-Powered Geotechnics: Enhancing Rock Mass Classification for Safer Engineering Practices
Saadati, G., Javankhoshdel, S., Abad, J. M. N., Mett, M., Kontrus, H., & Schneider‐Muntau, B. (2024) · Rock Mechanics and Rock Engineering · doi:10.1007/s00603-024-04189-7 · Cited by 37
Quality Inference in Federated Learning With Secure Aggregation
Pejó, B., & Biczók, G. (2023) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2023.3280406 · Cited by 43
“These could be categorized into model inference [12], membership inference [43], parameter inference [47], and property inference [15, 36].”
BackgroundOlszewski, D., Lu, A., Stillman, C., Warren, K., Kitroser, C., Pascual, A., Ukirde, D., Butler, K. R. B., & Traynor, P. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623130 · Cited by 52
Poisoning and Evasion: Deep Learning-Based NIDS under Adversarial Attacks
Mohammadian, H., Lashkari, A. H., & Ghorbani, A. A. (2024) · Conference on Privacy, Security and Trust · doi:10.1109/pst62714.2024.10788064 · Cited by 32
A review of federated learning: taxonomy, privacy and future directions
Ratnayake, H., Chen, L., & Ding, X. (2023) · Journal of Intelligent Information Systems · doi:10.1007/s10844-023-00797-x · Cited by 32
“These attacks are based on the idea that machine learning models trained on similar data sets using similar training methods will represent similar functions (Ganju et al., 2018).”
InfluentialEvaluating the Cybersecurity Risk of Real-world, Machine Learning Production Systems
Bitton, R., Maman, N., Singh, I., Momiyama, S., Elovici, Y., & Shabtai, A. (2022) · ACM Computing Surveys · doi:10.1145/3559104 · Cited by 35
“These attacks can be performed using shadow models, leveraging the adversary’s access to the target model’s predictions ([AC9][AC10]), and partial knowledge on the training data, leveraging [AC4], [AC5], [AK5], and the target system’s task [AK8] [5, 28, 75].”
MethodRobust and Secure Federated Learning Against Hybrid Attacks: A Generic Architecture
Hao, X., Lin, C., Dong, W., Huang, X., & Xiong, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3336521 · Cited by 27
“The adversary utilize existing knowledge to infer whether a sample of data is included in the target user’s training dataset [35].”
BackgroundPrivacy Threats and Protection in Machine Learning
Zhang, J., Li, C., Ye, J., & Qu, G. (2020) · ACM Great Lakes Symposium on VLSI (GLSVLSI) · doi:10.1145/3386263.3407599 · Cited by 27
“Ganju et al. [13] proved the permutation invariance of the fully connected NN, and developed methods based on neuron sorting and set representation to infer global properties of the training set.”
MethodChen, Z., & Pattabiraman, K. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23014 · Cited by 40
GAMIN: An Adversarial Approach to Black-Box Model InversionPreprint
Aïvodji, U., Gambs, S., & Ther, T. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.11835 · Cited by 54
“In contrast to previous implementations of such attacks [34, 35] that work in the white-box setting, GAMIN aims to infer properties of the target model’s training set in the black-box agnostic setting.”
InfluentialSplit Aggregation: Lightweight Privacy-Preserving Federated Learning Resistant to Byzantine Attacks
Lu, Z. G., Lu, S., Cui, Y., Tang, X., & Wu, J. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402993 · Cited by 30
“They train an attack model with predictions and metadata to infer properties from the global model data [9], [10].”
BackgroundFedCRI: Federated Mobile Cyber-Risk Intelligence
Fereidooni, H., Dmitrienko, A., Rieger, P., Miettinen, M., Sadeghi, A., & Madlener, F. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23153 · Cited by 29
Gradient leakage attacks in federated learning
Gong, H., Jiang, L., Liu, X., Wang, Y., Gastro, O., Wang, L., Zhang, K., & Guo, Z. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-023-10550-z · Cited by 30
“Through these attacks, they can realize membership inference attacks or property inference attacks, which can be found in (Ganju et al. 2018; Salem et al. 2018; Liu et al. 2019; Carlini and Liu 2019; Melis et al. 2019; Sablayrolles et al. 2019; Shokri et al. 2021a).”
BackgroundFeature Inference Attack on Shapley Values
Luo, X., Jiang, Y.-F., & Xiao, X. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560573 · Cited by 24
“Previous studies, such as membership inference [47, 51] and property inference [24, 36], assume that the adversary owns an auxiliary dataset Xaux following the same underlying distribution of the target samples.”
BackgroundInvestigating Membership Inference Attacks under Data Dependencies
Humphries, T., Oya, S., Tulloch, L., Rafuse, M., Goldberg, I., Hengartner, U., & Kerschbaum, F. (2023) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf57540.2023.00013 · Cited by 35
“is not to conduct a property inference attack or be competitive with state-of-the-art attacks in this field [26]–[28], [58], [59].”
BackgroundInfluentialBeyond federated learning: On confidentiality-critical machine learning applications in industry
Zellinger, W., Wieser, V., Kumar, M., Brunner, D. J., Shepeleva, N., Gálvez, R., Langer, J., Fischer, L., & Moser, B. (2021) · Procedia Computer Science · doi:10.1016/j.procs.2021.01.296 · Cited by 24
Leveraging Domain Adaptation as a Defense Against Membership Inference Attacks
Huang, H., Luo, W., Zeng, G., Weng, J., Zhang, Y., & Yang, A. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3088480 · Cited by 30
“the security setting in DL, which has been widely discussed in previous efforts [7], [8], [9], [10].”
Adversarial machine learning threat analysis and remediation in Open Radio Access Network (O-RAN)
Habler, E., Bitton, R., Avraham, D., Klevansky, E., Mimran, D., Brodt, O., Lehmann, H., Elovici, Y., & Shabtai, A. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104090 · Cited by 24
“…additional threats to ML models, including (a) privacy threats (such as membership inference [13], [14]), data property inference [15], [16], [17], data reconstruction [18], [19], and model extraction [20], [21], [22], [23]; and (b) availability threats (such as model corruption [24],…”
PRoT-FL: A privacy-preserving and robust Training Manager for Federated Learning
Gamiz, I., Regueiro, C., Jacob, E., Lage, Ó., & Higuero, M. (2024) · Information Processing & Management · doi:10.1016/j.ipm.2024.103929 · Cited by 23
Wainakh, A., Zimmer, E., Subedi, S., Keim, J., Grube, T., Karuppayah, S., Guinea, A. S., & Mühlhäuser, M. (2022) · Sensors · doi:10.3390/s23010031 · Cited by 26
“• Property inference: The adversary aims to infer features of the training dataset, where these features are not intended to be used for the main task of the model [39].”
BackgroundSeeing is believing: Towards interactive visual exploration of data privacy in federated learning
Guo, Y., Liu, F., Zhou, T., Cai, Z., & Xiao, N. (2022) · Information Processing & Management · doi:10.1016/j.ipm.2022.103162 · Cited by 22
Zhou, J., Li, H., Liao, X., Zhang, B., He, W., Li, Z., Zhou, L., & Gao, X. (2023) · Nature Communications · doi:10.1038/s41467-023-41703-x · Cited by 25
Exploiting Defenses against GAN-Based Feature Inference Attacks in Federated Learning
Luo, X., & Zhang, X. (2025) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3719350 · Cited by 34
“…which is later improved by [45] under loose assumptions, and by [43] in the setting of FL. Property inference attacks aim to infer aggregate statistics of the training dataset, such as the statistics of software execution traces [10] and the age distribution of a bank’s customer data [24].”
InfluentialBackdoor Attack through Frequency DomainPreprint
Wang, T., Yao, Y., Xu, F., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.10991 · Cited by 22
“Recent work has shown that CNNs are exploitable to a variety of attacks such as adversarial attack [11], membership inference attack [59], property inference attack [21], and model inversion attack [73].”
BackgroundA comprehensive survey and taxonomy on privacy-preserving deep learning
Tran, A.-T., Luong, T.-D., & Huynh, V.-N. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127345 · Cited by 21
Subject Property Inference Attack in Collaborative Learning
Xu, M., & Li, X. (2020) · International Conference on Intelligent Human-Machine Systems and Cybernetics · doi:10.1109/ihmsc49165.2020.00057 · Cited by 23
“Recent works have restored the statistical characteristics of the training dataset [4]–[6], and infer task-independent properties or attributes of subset of the training set [7], [8].”
BackgroundMethodByzantine-robust Federated Learning through Spatial-temporal Analysis of Local Model Updates
Li, Z., Liu, L., Zhang, J., & Liu, J. (2021) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads53394.2021.00052 · Cited by 25
“Additionally, methods based on distributed momentum [17], [18] have been proposed to defeat”
BackgroundMethodPPT: A privacy-preserving global model training protocol for federated learning in P2P networks
Chen, Q., Wang, Z., Zhang, W., & Lin, X. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102966 · Cited by 23
Membership Inference Attacks Against Deep Learning Models via Logits Distribution
Yan, H., Li, S., Wang, Y., Zhang, Y., Sharif, K., Hu, H., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3222880 · Cited by 24
“els or the synthetic data outputs to infer membership of samples to the training datasets [1], [2], [3], [4], [5], [6], [7].”
BackgroundFedShare: Secure Aggregation based on Additive Secret Sharing in Federated Learning
Khojir, H. F., Alhadidi, D., Rouhani, S., & Mohammed, N. (2023) · International Database Engineering and Applications Symposium (IDEAS) · doi:10.1145/3589462.3589504 · Cited by 22
“Property inference attacks aim to infer properties of the training records [14, 32].”
BackgroundSNAP: Efficient Extraction of Private Properties with Poisoning
Chaudhari, H., Abascal, J., Oprea, A., Jagielski, M., Tramèr, F., & Ullman, J. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179334 · Cited by 26
“In a property inference attack [1]–[4] (also called distribution inference [5]), an adversary with query access to a trained model infers global properties of a training dataset, for example, the fraction of people belonging to a certain demographic group or with a rare disease.”
InfluentialIndividualized PATE: Differentially Private Machine Learning with Individual Privacy Guarantees
Boenisch, F., Mühl, C., Rinberg, R., Ihrig, J., & Dziedzic, A. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0010 · Cited by 21
“At the same time, training data leakage is ubiquitous [17, 18, 35], motivating approaches that integrate differential privacy (DP) [12].”
BackgroundPrivacy-Preserving Federated Deep Reinforcement Learning for Mobility-as-a-Service
Chu, K.-F., & Guo, W. (2023) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2023.3317358 · Cited by 20
“As the gradient still contains the client’s information implicitly, attack methods such as membership inference attacks [7], model inversion attacks [8], and property inference attacks [9] can be used to infer that information.”
BackgroundEAR: An Enhanced Adversarial Regularization Approach against Membership Inference Attacks
Hu, H., Salcic, Z. A., Dobbie, G., Chen, Y., & Zhang, X. (2021) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534381 · Cited by 19
Turning Federated Learning Systems Into Covert Channels
Costa, G., Pinelli, F., Soderi, S., & Tolomei, G. (2022) · IEEE Access · doi:10.1109/access.2022.3229124 · Cited by 35
“For instance, model inversion attacks [21], [22], membership inference attacks [50], [62], [66], and property inference attacks [2], [24] aim to violate the confidentiality of user’s”
BackgroundIslam, F., Raihan, A. S., & Ahmed, I. (2023) · International Conference on Industrial Engineering and Operations Management (IEOM) · doi:10.46254/na8.20230219 · Cited by 25
“(Ganju et al., 2018) Security and Privacy Property inference attacks aim to uncover the statistical characteristics of data sources.”
BackgroundInterpretable Complex-Valued Neural Networks for Privacy ProtectionPreprint
Xiang, L., Ma, H., Zhang, H., Zhang, Y., Ren, J., & Zhang, Q. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.09546 · Cited by 22
“…attack 1 , the adversary tries to find out the most likely rotated angle ˆ θ to revert the feature x and obtain a Property inference attacks: By Ganju et al. (2018), ‘property’ refers to the input attribute, which can be any sensitive information to protect or any attribute not expected to be…”
BackgroundInfluentialEvaluation of Inference Attack Models for Deep Learning on Medical DataPreprint
Wu, M., Zhang, X., Ding, J., Nguyen, H. V., Rong, Y., Pan, M., & Wong, S. T. C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.00177 · Cited by 33
“Other Attacks against Machine Learning Besides attribute inference attack and membership inference attack, there exist numerous other types of attacks against ML models [16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38].”
BackgroundAdvancing accountability in AI
OECD (2023) · OECD digital economy papers · doi:10.1787/2448f04b-en · Cited by 42
ROBY: A Byzantine-Robust and Privacy-Preserving Serverless Federated Learning Framework
Tang, X., Li, M., Shen, M., Kang, J., Zhu, L., Liu, Z., Yang, G., Niyato, D. T., & Deng, R. H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3589066 · Cited by 21
“But, it tries to extract other data owners’ local data as much as possible from global models and other legitimate knowledge [60], via launching inference attacks [53], [54] and data reconstruction attacks [27], [28], [29], [58].”
InfluentialLi, J., Liao, G., Chen, L., & Chen, X. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3312304 · Cited by 17
“, [25], [44]) indicated that specific properties or whether an instance in the dataset may be inferred from the intermediate representation given some background knowledge.”
BackgroundFederify: A Verifiable Federated Learning Scheme Based on zkSNARKs and Blockchain
Keshavarzkalhori, G., Pérez‐Solà, C., Navarro‐Arribas, G., Herrera‐Joancomartí, J., & Yajam, H. A. (2023) · IEEE Access · doi:10.1109/access.2023.3347039 · Cited by 18
“Property inference attacks refer to the disclosure of properties of the training data not the data itself (e.g. location, testing environment, ...) [12], [25], [42].”
BackgroundMao, Y., Xin, Z., Li, Z., Hong, J., Yang, Q., & Zhong, S. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-51482-1_2 · Cited by 23
Benchmarking robustness and privacy-preserving methods in federated learning
Alebouyeh, Z., & Bidgoly, A. J. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.01.009 · Cited by 19
Membership Inference Attacks are Easier on Difficult Problems
Shafran, A., Peleg, S., & Hoshen, Y. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01455 · Cited by 18
{DRMI}: A Dataset Reduction Technology based on Mutual Information for Black-box Attacks
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2021) · USENIX Security Symposium · Cited by 16
Knowledge Cross-Distillation for Membership Privacy
Chourasia, R., Enkhtaivan, B., Ito, K., Mori, J., Teranishi, I., & Tsuchida, H. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0050 · Cited by 22
Lebrun, T., Boutet, A., Aalmoes, J., & Baud, A. (2022) · International Middleware Conference · doi:10.1145/3528535.3565240 · Cited by 23
A survey on machine unlearning: Techniques and new emerged privacy risks
Liu, H., Xiong, P., Zhu, T., & Yu, P. S. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104010 · Cited by 32
Improved Techniques for Model Inversion AttacksPreprint
Chen, S., Jia, R., & Qi, G.-J. (2021) · arXiv (Cornell University) · Cited by 16
Yang, Y., Yuan, H., Hui, B., Gong, N. Z., Fendley, N., Burlina, P., & Cao, Y. (2023) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58367.2023.00037 · Cited by 16
Deep reinforcement learning for forecasting fish survival in open aquaculture ecosystem
Agrawal, S., Dubey, S., & Naik, K. J. (2023) · Environmental Monitoring and Assessment · doi:10.1007/s10661-023-11937-9 · Cited by 15
“Equation (3) represents the f ( x ) or y output of the neural network (Ganju et al., 2018). where | f | signifies the absolute numbers of processing layers, in which a neural network may include hidden layers and output layers, and x is the input.”
BackgroundÖksüz, A. Ç., Halimi, A., & Ayday, E. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2024-0137 · Cited by 18
Threat Modeling AI/ML With the Attack Tree
Hoseini, S. V., Suutala, J., Partala, J., & Halunen, K. (2024) · IEEE Access · doi:10.1109/access.2024.3497011 · Cited by 22
“Ganju et al. [79], [80] extracted properties by white-box access from a full forward deep neural network model.”
Inferring Sensitive Attributes from Model Explanations
Duddu, V., & Boutet, A. (2022) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3511808.3557362 · Cited by 15
“Given a POI (cid:174) 𝑥 , we assume that 𝑓 𝑡𝑎𝑟𝑔𝑒𝑡 can output both the model prediction ( 𝑓 ((cid:174) 𝑥 ) ) and corresponding explanations on that input ( 𝜙 ((cid:174) 𝑥 ) ).”
Fault tolerance of neural networks in adversarial settings
Duddu, V., Pillai, N. R., Rao, D. V., & Bălaş, V. E. (2020) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-179677 · Cited by 16
“Alternatively, in an adversarial setting under a privacy threat model, an adversary performs inference attacks to identify training data attributes or membership details for sampled data point [15][33][31].”
Federated Synthetic Data Generation with Stronger Security Guarantees
Ghavamipour, A. R., Türkmen, F., Wang, R., & Liang, K. (2023) · ACM Symposium on Access Control Models and Technologies (SACMAT) · doi:10.1145/3589608.3593835 · Cited by 16
Trustworthy decentralized collaborative learning for edge intelligence: A survey
Yu, D., Xie, Z., Yuan, Y., Chen, S., Qiao, J., Wang, Y., Yu, Y. H., Zou, Y., & Zhang, X. L. (2023) · High-Confidence Computing · doi:10.1016/j.hcc.2023.100150 · Cited by 17
On Data Distribution Leakage in Cross-Silo Federated Learning
Jiang, Y., Luo, X., Wu, Y., Zhu, X., Xiao, X., & Ooi, B. C. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3349323 · Cited by 16
“Third , the existing property [13], [74], [75], category [34], and class representation attacks [6] rely heavily on sensitive auxiliary datasets, which can hardly be collected by the adversary in advance [33].”
BackgroundNetwork anomaly detection via similarity-aware ensemble learning with ADSim
Chen, W., Wang, Z., Chang, L., Wang, K., Zhong, Y. C., Han, D., Duan, C., Yin, X., Yang, J., & Shi, X. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110423 · Cited by 14
Li, Y., Liu, Y., Li, B., Wang, W., & Liu, N. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103147 · Cited by 14
Cracking White-box DNN Watermarks via Invariant Neuron Transforms
Pan, X., Zhang, M., Yan, Y., Wang, Y., & Yang, M. (2023) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3580305.3599291 · Cited by 18
“Then we can randomly shuffle the nodes in each intermediate layer f l with the incoming weights and outgoing weights to obtain an equivalent model [39].”
MethodMembership Leakage in Label-Only ExposuresPreprint
Li, Z., & Zhang, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.15528 · Cited by 15
“[20] proposed a property inference attack aiming at inferring general properties of the training data (such as the proportion of each class in the training data).”
BackgroundMao, Y., Hong, W., Zhu, B., Zhu, Z., Zhang, Y., & Zhong, S. (2021) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2021.3129612 · Cited by 13
“Previous studies have proved that DNN model publishing can break data privacy seriously, such as label-representative information [14], [15], membership information [9], [19], [20], [21], task-relevant properties [12], [13] and even human genomic data [22].”
BackgroundPrivacy-Preserving Federated Class-Incremental Learning
Xiao, J., Tang, X., & Lu, S. (2023) · IEEE Transactions on Machine Learning in Communications and Networking · doi:10.1109/tmlcn.2023.3344074 · Cited by 13
“However, studies [17], [18], [19], [20] have shown that merely transmitting gradients can still be susceptible to various attacks.”
BackgroundArevalo, C. A., Noorbakhsh, S. L., Dong, Y., Hong, Y., & Wang, B. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i10.28965 · Cited by 14
Metadata
- Authors
- Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- The University of Texas at Dallas (US)
- Venue
- Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2018-10-15
- Pages
- 619-633
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2897830718
- Semantic Scholar
- 490c30b1d6b680be3c5a13552073e4fc10a850dc
- Cited by
- 475
- References
- 37
- Citations by year
- 2026: 27 · 2025: 58 · 2024: 89 · 2023: 98 · 2022: 74 · 2021: 69 · 2020: 39 · 2019: 19 · 2018: 2
- FWCI
- 13.11
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- U.S. Department of Energy (DE-OE0000780)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- property inference attacks, fully connected neural network, permutation invariance, training data leakage, white-box attacks, model sharing, performance counters
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
