PaperlayerView exact revision on arXiv

Source-linked AI summary

Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks

Ali Akarma, Toqeer Ali Syed, Muhammad Khan, Qurat-ul-ain Mastoi, Adeel Ahmad

arXiv:2609.02971v2cs.CRcs.LGcs.NI

TL;DR

Federated learning keeps raw data local, but transmitted updates can still reveal client identity, a risk for safety-critical vehicular applications. The paper evaluates identity inference from inertial-data updates and tests noise-based and structural defenses. Undefended updates yield near-perfect identification, while clip-then-noise reduces attacks toward random levels with FL accuracy above 0.89 in the stated operating region.

Abstract

from arXiv · show

As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with near-perfect accuracy (approximately 1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacy-utility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (sigma in {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C=1.0), and report formal (epsilon, delta)-DP budgets through Renyi accounting. A practical region (sigma in [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA-256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require.

I. INTRODUCTION

Federated learning keeps vehicular sensor data local, but transmitted updates can still expose client identity to an honest-but-curious server. This paper studies that risk using inertial data and evaluates defenses on HAR as a proxy for vehicular sensing.

I. INTRODUCTION

  • An honest-but-curious server can match incoming updates to vehicles, creating a privacy concern in safety-critical settings.FL keeps sensor data local, but gradients can still leak information.Source: §I · p. 1
  • Client identity inference is less studied than reconstruction and membership inference, while some defenses protect per-batch gradients rather than the transmitted artifact.The experiments use UCI HAR, which shares IMU modality with vehicular sensing but not its dynamics.Source: §I · p. 1
  • The threat model applies defenses to transmitted weight deltas, the artifacts the server observes, rather than to inaccessible per-batch gradients.The server aggregates correctly but attempts to attribute each transmitted delta to its client.Source: §I · p. 1
  • The study combines five attack classifiers, cryptographically disjoint train and evaluation updates, a six-level Gaussian noise sweep, and ensemble FL with a 1/K attack-accuracy bound.It also introduces count-normalized attacker advantage for comparisons across client counts.Source: §I · pp. 1–2

II. RELATED WORK

Prior gradient-privacy research has emphasized reconstruction and membership inference, with less attention to attributing updates to specific clients. This paper distinguishes itself by evaluating defended transmitted deltas and calibrated privacy–utility operating points.

II. RELATED WORK

  • Federated learning protocols and inference threats in IoT and vehicular environments are surveyed by Mothukuri et al. and Lyu et al..Hsieh et al. report greater inference vulnerability with non-IID data distributions.Source: §II · p. 2
  • Most gradient-leakage studies reconstruct inputs or infer record membership,,, whereas Wang et al. study separability of non-IID FL gradients.This work instead evaluates defended transmitted deltas, uses cryptographically disjoint train/test sets across five classifiers, and analyzes defense operating points.Source: §II · p. 2
  • Prior defenses include differential privacy, DP-SGD, Rényi accounting, client-level DP, secure aggregation, and sparse ternary updates.Client-level DP hides participation, whereas this paper targets attribution after participation is known.Source: §II · p. 2
  • Table I positions prior work by evaluation artifact—per-batch gradient or transmitted weight delta—and whether it reports a calibrated privacy–utility operating point.Source: Table I · p. 2

A. FL Formulation and Data Partitioning

The formulation uses cross-device federated learning with a central server, client-local training, and FedAvg aggregation. Experiments primarily use Dirichlet label skew and compare four additional data partitions.

A. FL Formulation and Data Partitioning

  • The study considers cross-device FL with 10 clients and one central server.The global objective uses client empirical losses and local sample counts.Source: A. FL Formulation and Data Partitioning · p. 2
  • Each client runs local SGD epochs, computes a weight delta, and uploads it for server-side FedAvg aggregation.The formulation defines client empirical loss and local sample count.Source: A. FL Formulation and Data Partitioning · p. 2
  • Primary experiments use Dirichlet(α=0.3) label skew and compare IID, pathological class, quantity, and feature-skew partitions.The label skew is used to model fleet heterogeneity across road conditions, driving behaviors, and geography.Source: A. FL Formulation and Data Partitioning · p. 2

B. Task Model and Attack Protocol

The task model is an MLP, and the attack protocol collects defended updates, trains classifiers, then evaluates them on new uploads. SHA-256 hash disjointness separates training updates from evaluation updates.

B. Task Model and Attack Protocol

  • The task model is an MLP with 561→256→128→6 layers, LayerNorm, ReLU, and dropout of 0.3 after each hidden layer.LayerNorm is used instead of BatchNorm because the latter's running statistics are averaged incorrectly across non-IID clients.Source: B. Task Model and Attack Protocol · p. 2
  • The protocol collects defended weight deltas for rounds 1–8, then trains five classifiers on normalized, standardized, and PCA-reduced updates.The classifiers include random and majority baselines, logistic regression, random forest, and an MLP attacker.Source: B. Task Model and Attack Protocol · pp. 2–3
  • Figure 1 depicts a differentially private federated learning system under an honest-but-curious server's inference attack.Source: Figure 1 · p. 3
  • During rounds 9–20, trained classifiers evaluate new uploads, with SHA-256 hash disjointness preventing overlap with training updates.Source: B. Task Model and Attack Protocol · p. 3

C. Defense Mechanisms

The defense clips each transmitted weight delta and then adds Gaussian noise, using low-overhead mechanisms intended for vehicular edge constraints.

C. Defense Mechanisms

  • Clipping and isotropic Gaussian noise are applied sequentially to each transmitted weight delta.Both defenses are chosen for low overhead compatible with vehicular edge constraints.Source: C. Defense Mechanisms · p. 3
  • Gradient clipping bounds the delta’s ℓ2 norm to at most C.The effective noise scale σC follows the Gaussian mechanism; in E2, C=1.0 is fixed and σ=0.00 means clipping only.Source: C. Defense Mechanisms · p. 3
  • Gaussian noise injection adds isotropic noise calibrated to the clipped sensitivity.Its effective scale is σC.Source: C. Defense Mechanisms · p. 3

D. Formal Differential Privacy Analysis

The analysis reports formal privacy budgets for Gaussian noise and presents ensemble FL as a structural identity-inference defense, with a bound conditional on within-group indistinguishability.

D. Formal Differential Privacy Analysis

E. Ensemble FL and Privacy Metrics

  • Ensemble FL assigns non-overlapping groups of K clients to separate sub-models, providing structural privacy without per-update noise overhead.The grouping maps to vehicular segmentation by RSU coverage zone or trust domain.Source: E. Ensemble FL and Privacy Metrics · p. 3
  • With K clients per non-overlapping group, ensemble FL bounds single-sub-model identity inference at 1/K if within-group updates are statistically indistinguishable.Each group is served by its own sub-model.Source: E. Ensemble FL and Privacy Metrics · p. 3
  • Heavy intra-group label or feature skew, or very small groups, can restore separability and raise empirical attack accuracy above 1/K.The stated bound is a best case for the defender; deployments should monitor within-group separability and treat K as tunable.Source: E. Ensemble FL and Privacy Metrics · p. 3
  • Privacy Score is defined as 1 minus the best attack accuracy.It summarizes privacy and utility alongside the Normalized Attacker Advantage.Source: E. Ensemble FL and Privacy Metrics · p. 3
  • NAA rescales attack accuracy against the random-guess floor 1/N, enabling comparisons across experiments with different client counts.NAA=0 means no gain over random guessing and NAA=1 a perfect attack; it is not a standalone privacy guarantee.Source: E. Ensemble FL and Privacy Metrics · p. 3

IV. EXPERIMENTAL SETUP

The evaluation uses UCI HAR as an IMU proxy, partitions training data across ten non-IID clients, and evaluates seven conditions over three seeds.

IV. EXPERIMENTAL SETUP

  • UCI HAR contains 10,299 observations from 30 subjects performing six activities, represented as 561-dimensional features derived from accelerometer and gyroscope readings at 50 Hz.The shared IMU modality motivates its use as a proxy for vehicular driving-state and occupant-behavior recognition.Source: §IV · pp. 3–4
  • Training samples are partitioned across N=10 clients using Dirichlet(α=0.3), with features standardized using training-set statistics only.Results are reported as mean ± standard deviation over three seeds: 42, 43, and 44.Source: §IV · p. 4
  • Seven conditions cover undefended FedAvg, noise and clipping sweeps, combined defense, ensemble FL, and non-IID heterogeneity; Table III lists hyperparameter configuration.The noise sweep uses σ∈{0.00, 0.05, 0.10, 0.20, 0.50, 1.00} at fixed C=1.0.Source: §IV · p. 4, Table III · p. 4

V. RESULTS AND DISCUSSION

Undefended transmitted updates reveal client identity with near-perfect accuracy under the tested non-IID partition. Clipping and Gaussian noise reduce attack accuracy, with σ∈[0.1, 0.2] retaining FL accuracy above 0.89.

A. Baseline: Gradient Identifiability (E1)

  • ≈1.000 accuracy is achieved by logistic regression, random forest, and MLP on held-out uploads, versus 0.100 for random and majority baselines.The result uses Dirichlet(α=0.3), N=10, and rounds 9–20.Source: A. Baseline: Gradient Identifiability… · p. 4

B. Privacy-Utility Tradeoff Under Gaussian Noise (E2)

  • σ=0.2 yields FL accuracy 0.896, while σ=1.0 reduces it to 0.382; σ∈[0.1, 0.2] keeps FL accuracy above 0.89 with near-random attack accuracy.The Gaussian noise sweep fixes clipping at C=1.0.Source: B. Privacy-Utility Tradeoff Under… · p. 4
  • σ=0.00 clipping alone reduces attack accuracy from ≈1.000 to 0.127±0.020, but gradient direction still leaks identity.Magnitude normalization weakens separability without eliminating identity information.Source: B. Privacy-Utility Tradeoff Under… · p. 4

C. Gradient Clipping and Combined Defense (E3, E4)

Clipping removes gradient-norm variance and bounds sensitivity for Gaussian DP noise; ensemble FL offers a separate structural privacy-utility option without noise.

C. Gradient Clipping and Combined Defense (E3, E4)

  • Clipping removes gradient-norm variance, the main magnitude channel distinguishing clients, while some identity information remains in gradient direction.The combined defense is described as the strongest balance for σ∈{0.01, 0.1, 0.2} at C=1.0.Source: C. Gradient Clipping and Combined… · p. 4
  • The passage says that adding Gaussian noise without clipping provides no reliable DP guarantee, and refers to the Gaussian mechanism in connection with satisfying DP semantics.Source: C. Gradient Clipping and Combined… · p. 4

D. Ensemble FL and Structural Privacy (E5)

  • 0.50, 0.33, and 0.20 attack accuracy are observed for ensemble groups of K=2, 3, and 5, respectively, while FL accuracy remains near 0.92.The K=3 setting offers the reported best balance for latency-sensitive VANETs.Source: D. Ensemble FL and Structural Privacy… · p. 4
  • Ensemble FL provides structural privacy without noise and maps naturally to RSU-zone or trust-domain segmentation.Larger groups increase anonymity but slightly reduce specialization.Source: D. Ensemble FL and Structural Privacy… · p. 4

E. Non-IID Heterogeneity and Summary (E6, E7)

Gradient distinguishability increases with non-IID heterogeneity, while the conclusion reports strong empirical privacy from clipping and noise and structural privacy from ensemble FL. The findings remain bounded by proxy data, limited experiment scale, and the stated server threat model.

E. Non-IID Heterogeneity and Summary (E6, E7)

  • σ=0.01 with C=1.0 achieves Privacy Score 0.880 while maintaining FL accuracy near 0.940, and greater non-IID heterogeneity increases gradient distinguishability.Even IID attacks exceed random guessing in early rounds; pathological partitioning produces nearly orthogonal updates and maximizes separability.Source: E. Non-IID Heterogeneity and Summary… · p. 4

F. Limitations

  • UCI HAR lacks realistic driving dynamics, including speed variation, road excitation, and GPS-correlated structure, so vehicular datasets may be more or less separable.The paper presents HAR as an IMU proxy rather than realistic vehicular telemetry.Source: F. Limitations · pp. 4–5
  • The experiments use N=10 clients, T=20 rounds, and three seeds, and assume a single honest-but-curious server rather than colluding clients, adaptive attackers, or malicious aggregators.The stated ensemble bound also assumes within-group indistinguishability, which strong intra-group non-IID skew may violate.Source: F. Limitations · p. 5

VI. CONCLUSION

  • At σ∈[0.1, 0.2] and C=1.0, attack accuracy falls to near-random while FL accuracy stays above 0.89; ensemble FL adds a structural 1/K bound without noise-induced utility loss.The conclusion identifies validation on true vehicular telemetry and evaluation against adaptive or colluding adversaries as immediate next steps.Source: §VI · p. 5

Related papers

Loading 2609.02971v2…