Membership Inference Attacks and Defenses in Federated Learning: A Survey

• Membership inference can reveal whether a sensitive record, such as a medical record, was used for training, despite FL keeping raw data local.The introduction also describes membership inference as a way to audit deletion requests and as a foundation for more advanced attacks.Source: §1 · p. 2
• Unlike centralized-learning attacks that commonly target released models, FL attacks can target the training process and exploit gradients, intermediate computations, outputs, and historical models.FL attackers may also be insiders with legitimate process access and can manipulate models through poisoning.Source: §1 · pp. 2–3
• Earlier surveys offer incomplete coverage of FL membership inference, with some omitting newer studies and the closest MIA survey focusing on centralized learning.Source: §1 · p. 3
• The survey organizes FL MIAs into update-based and trend-based approaches and reviews attacks using model updates and convergence trends.Source: §1 · pp. 3–4
• It categorizes defenses into partial sharing, secure aggregation, noise perturbation, and anomaly detection, analyzing their advantages and limitations.The survey also compares defenses in centralized learning and identifies future research directions.Source: §1 · pp. 3–4

2.1 Centralized Learning

• Centralized learning pools training data on a server and trains a model by minimizing training loss, with stochastic gradient descent updating parameters from mini-batches.The paper describes test accuracy as a way to validate the trained model.Source: §2.1 · p. 5

2.2 Federated Learning

• Federated learning keeps data at clients while exchanging model parameters or gradients to train a shared global model.The paper notes applications including smart healthcare and the Internet of Things.Source: §2.2.1 · p. 5

2.2.1 Brief Introduction of Federated Learning.

• Federated training repeats local training, communication, and server aggregation until global-model loss converges on a validation dataset.The server initializes and broadcasts the global model; selected clients train on local data and upload their updated models.Source: §2.2.1 · p. 6

2.2.2 Categorization of Federated Learning.

• Horizontal federated learning shares features but not sample IDs; vertical learning shares sample IDs but not features, while federated transfer learning differs in both spaces.The survey describes these as categories based on how data are distributed across sample and feature spaces.Source: §2.2.2 · pp. 6–7

2.3 Membership Inference Attacks in Centralized Learning

• Centralized membership inference determines whether a query example trained a target model, using either classifier-based or metric-based attacks.Classifier-based attacks use shadow models to train an attack classifier; metric-based attacks compare prediction-derived measures with a threshold.Source: §2.3 · p. 7

2.4 Membership Inference Defenses in Centralized Learning

• Centralized defenses include regularization, knowledge distillation, differential privacy, and output perturbation.Regularization and distillation target overfitting; differential privacy adds calibrated noise but can reduce utility, while output perturbation modifies inference outputs.Source: §2.4 · p. 8

3.1 Threat Model

• The threat-model overview compares attackers by goal, role, and strategy and discusses the adversarial knowledge available in each model.Figure 4 presents the threat-model categorization.Source: §3.1 · p. 8, Figure 4 · p. 8

3.2 Adversary’s Goal.

• Record-level attacks test membership in the overall training dataset, while source-level attacks identify the client whose local dataset contains the member.The survey notes that source-level attacks can reveal the institution associated with a record, such as a hospital.Source: §3.2 · p. 9

3.3 Adversary’s Role.

• Federated-learning attackers may be insiders, such as servers or clients, or outsiders who eavesdrop on communications.Servers can observe local models and manipulate aggregation; clients have less visibility, while eavesdroppers passively intercept messages.Source: §3.3 · p. 9

3.4 Adversary’s Strategy.

• Passive attackers observe normal system operation, whereas active insiders alter the model or data to improve inference.The survey states that active attacks are easier to mount in federated learning than centralized learning because participants or the server can modify data or model parameters.Source: §3.4 · pp. 9–10

3.5 Attack Taxonomy

• The survey groups federated-learning membership inference attacks into update-based attacks using historical target models and trend-based attacks tracking indicator trajectories.Table 3 summarizes the surveyed attacks in light of their different threat models.Source: §3.5 · p. 10, Table 3 · p. 10

4.1 Update-based Membership Inference Attacks

• Update-based attacks use exchanged gradients or model parameters, while trend-based attacks track how membership indicators change during learning.The survey further divides trend-based methods by prediction scores, prediction loss, or model parameters.Source: §4.1 · p. 11, §4.2 · p. 15, §4.3 · p. 17

4.1.1 Model Gradient-based MIAs.

• Gradient-based attacks use original gradients and intermediate features, or compare gradients across rounds to infer membership.Original-gradient attacks can use hidden outputs, loss, and labels; gradient-difference methods exploit changes between iterations, including embedding-layer signals.Source: §4.1.1 · pp. 11–12
• Original-gradient attacks can require partial victim-member data and many feature vectors; embedding-layer attacks are limited to neural networks with embeddings and face rising false positives at larger batch sizes.The survey also notes high computation and memory demands for collecting intermediate outputs.Source: §4.1.1 · p. 12, §4.1.2 · p. 15

4.1.2 Single Model-based MIAs.

• Single-model attacks adapt shadow training, augment attack data, modify target-model structures, or tailor inference to recommender interactions.Structure-modifying attacks use maliciously embedded units, while recommender attacks infer interacted items rather than the existence of a query example.Source: §4.1.2 · pp. 13–14

4.2 Trend-based Membership Inference Attacks

• Trend-based attacks compare indicator distributions over historical models, motivated by members’ prediction scores or losses often increasing faster as models converge.The survey describes prediction-trajectory methods using score sequences and also discusses confidence-series, poisoning, and label-only robustness approaches.Source: §4.2 · p. 15, §4.2.1 · pp. 15–16

4.2.1 Model Output-based MIAs.

• Prediction-trajectory attacks classify confidence sequences, while confidence-series attacks can use active server participation and client selection.The confidence-series approach is reported to outperform existing state-of-the-art black-box MIAs [26] [43] [86].Source: §4.2.1 · pp. 15–16

4.2.2 Model Parameter-based MIAs.

• Loss-trajectory attacks use loss changes across rounds or compare losses across clients, while bias-trajectory attacks analyze final-layer bias changes across epochs.The survey also describes subject-level inference and source-level inference, with bias differences used to identify a member’s source.Source: §4.2.1 · pp. 16–17, §4.2.2 · p. 17

4.3 Comparison to Attacks in Centralized Learning

• Compared with centralized learning, federated learning can expose internal model details and historical versions, enabling gradient-based and trend-based attacks; source-level inference also reflects its collaborative training structure.The survey describes source-level methods that compare losses or bias changes across clients.Source: §4.3 · pp. 18–19

5 MEMBERSHIP INFERENCE DEFENSES IN FEDERATED LEARNING

• The defense taxonomy contains partial sharing, secure aggregation, noise perturbation, and anomaly detection.The survey divides each category into specific approaches.Source: §5 · p. 19, Table 7 · p. 19
• The survey reviews existing strategies intended to alleviate privacy leakage through membership inference attacks in federated learning.Its defense overview is organized by the four categories in the taxonomy.Source: §5 · p. 19, Table 7 · p. 19
• Table 7 presents a taxonomy of membership-inference defenses in federated learning.The table classifies the approaches into the four categories named in the section.Source: Table 7 · p. 19, §5 · p. 19

5.1.1 Gradient Compression.

• Gradient compression selects a subset of updates, exchanges gradient signs, or replaces gradients with local-model predictions; some methods seek to preserve model performance.DSSGD uses top-K gradients, while other approaches use sparsification, momentum correction, clipping, or sign-based aggregation.Source: §5.1.1 · pp. 19–20
• When only 10% of updates are shared, attack accuracy on a two-party sentiment classifier decreases from 0.93 AUC to 0.84 AUC.The cited study evaluates DSSGD as a defense against membership inference attacks.Source: §5.1.1 · pp. 19–20

5.1.2 Weight Pruning.

• Weight pruning can leave fewer than 5% of original model parameters while maintaining comparable performance and more effectively mitigating membership inference.Balancing sparsity and accuracy may require retraining, and reusing training samples can increase memorization-related privacy risk.Source: §5.1.2 · p. 20

5.1 Partial Sharing

• Partial sharing reduces communication costs and can limit attack effectiveness, but provides only limited membership privacy because exchanged updates still carry training-data information.The survey notes that retaining gradients or parameters may be necessary to maintain model performance.Source: §5.1.1 · p. 19, §5.1.2 · p. 20

5.2 Secure Aggregation

• Secure aggregation discloses encrypted rather than clear model updates and includes secure multi-party computation and homomorphic encryption.These approaches allow designated participants to work with protected updates.Source: §5.2 · p. 20, §5.2.2 · p. 22

5.2.1 Secure Multi-party Computation.

• Secure multi-party computation can restrict an aggregator to learning only the sum or average of client updates, protecting individual updates from eavesdroppers or a curious server.Protocols are expected to provide correctness and privacy.Source: §5.2.1 · p. 21
• The survey reports that secure aggregation’s membership-privacy effectiveness is limited: SecAgg may fail against client-side attacks or collusion, and its guarantee depends on model dimensionality and client count.It also describes SMC protocols as costly in practical applications and presents SAFELearn as an alternative requiring two communication rounds and allowing client dropouts.Source: §5.2.1 · p. 21

5.2.2 Homomorphic Encryption.

• Homomorphic encryption permits operations on ciphertexts without restoring plaintext, but introduces computational and communication overhead.The survey also notes that a curious participant may compromise privacy protected by SMC and HE.Source: §5.2.2 · pp. 21–22

5.3.1 Differential Privacy.

• DP bounds limit membership advantage, but their assumptions and large-ε or non-IID cases constrain how well they reflect practical FL risks.The reviewed bounds assume black-box attacks and IID members in some analyses; under non-IID dependencies, a membership-advantage bound can be very large.Source: §5.3.1 · pp. 22–23
• LDP adds noise locally for record-level protection, but stronger protection can require stringent privacy budgets and reduce utility.One study reported reducing attack accuracy from 73% to 52%; another found vanilla LDP ineffective against prediction-loss attacks in FL, with near-random guessing below ε=2 at significant utility cost.Source: §5.3.1 · p. 23
• CDP clips and aggregates client updates before adding noise; reported evaluations show protection against white-box passive and active MIAs, with utility costs.One study reduced attack accuracy from 75% to 52% with about a 16% utility drop on CIFAR100; another found client-level protection strongest and LDP weakest.Source: §5.3.1 · pp. 23–24

5.3.2 Random Perturbation.

• Random update perturbation can reduce attack accuracy by about 50% while maintaining learning accuracy, but the reported method is limited to ReLU networks and assumes a trustworthy server.The approach uses Hadamard products and linear outputs to restrict access to true global parameters and local gradients.Source: §5.3.2 · p. 24
• Other perturbation strategies alter client data distributions or anonymize inputs; crafted noise is presented as a better utility-privacy trade-off than DP.The section also describes optimization-guided noise and notes that relaxed LDP can reduce utility loss while revealing more private information.Source: §5.3.1 · p. 23, §5.3.2 · p. 24

5.4 Anomaly Detection

• Poisoning MIAs target sample-level membership leakage, unlike conventional poisoning attacks that seek to compromise overall model performance.The section says robust aggregation methods such as Multi-Krum, Trimmed-Mean, and FLTrust are inadequate against this active threat.Source: §5.4 · p. 24
• Anomaly detection is tailored to combat active MIAs that exploit poisoning vulnerabilities in collaborative training.The attack context includes malicious model or data manipulations that enhance membership leakage.Source: §5.4 · p. 24
• LoDEN flags samples whose predictions shift from correct to incorrect over several iterations, then removes those samples and their neighbors from later training.It monitors model outputs to identify malicious updates associated with gradient-ascent attacks.Source: §5.4 · pp. 24–25

5.5 Comparison to Defenses in Centralized Learning

• The four FL defense strategies differ in scope: partial sharing hides updates, secure aggregation mainly protects against server-side attacks, DP offers broad theoretical protection with utility loss, and anomaly detection targets active attacks.Secure aggregation does not prevent inference by clients with legitimate access to the global model; anomaly detection is ineffective against passive attacks.Source: §5.5 · p. 26
• Model updates create an additional membership-privacy breach avenue in FL, distinguishing its defenses from those used in centralized learning.The comparison considers both when countermeasures are applied and what they protect against.Source: §5.5 · p. 26
• The survey compares centralized and federated defenses by implementation phase and the objects they protect against information leakage.It identifies partial sharing, secure aggregation, and anomaly detection as strategies that differ significantly across the two settings.Source: §5.5 · p. 26

6.1 Research Direction about Membership Inference Attacks

• Attack evaluations should account for false alarms and source-level membership, while testing assumptions such as IID data, few participants, and participation in every round.The survey notes that heterogeneous data and participant joining times can affect inference risk and attack performance.Source: §6.1 · p. 26
• Membership risks remain underexplored in decentralized FL, and prior MIAs are generally ineffective in VFL when parties hold partial features and an incomplete target model.The survey also proposes combining MIAs with poisoning or backdoor attacks and investigating factors associated with leakage, including internal exposure, non-IID samples, and cooperative learning.Source: §6.1 · p. 27

6.2 Research Direction about Membership Inference Defenses

• Defense studies lack a unified benchmark: evaluations use different MIAs, datasets, and networks, making results difficult to compare and mitigation choices difficult to assess.The survey also calls for testing defenses under realistic assumptions and attack scenarios, including non-IID data and homogeneous model architectures.Source: §6.2 · p. 27
• Existing defenses do not jointly provide strong privacy, small utility losses, and low computational cost; the survey proposes integrating methods as one possible response.It notes that DP can incur large utility loss, partial sharing may only slightly reduce attack performance, and secure aggregation can be computationally costly.Source: §6.2 · p. 27
• Defense design should account for interactions among attacks because DP may create an opportunity for poisoning attacks to evade anomaly detection, while MIA mitigation may improve model extraction.The survey frames these as risks to consider when developing robust defenses.Source: §6.2 · p. 28

• The survey categorizes membership inference research by attack knowledge into update-based and trend-based approaches.Source: §7 · p. 28
• Federated-learning defenses covered range from partial sharing techniques to noise perturbation.Source: §7 · p. 28
• Future research opportunities include novel attack vectors across diverse federated-learning settings, refined defenses, and robust privacy-preserving techniques.The survey says these future studies can help enhance security and privacy guarantees in federated learning.Source: §7 · p. 28