Neuron Membership Inference Attack in Federated Learning for bit Scenarios

Federated learning (FL) is a secure approach to protecting client data privacy by remaining data local. However, semi-honest central servers expose clients to the risk of membership inference attacks (MIA). Differential privacy is often used to defend against MIA in FL, but the differential privacy-based federated learning (DP-FL) still faces the risk of privacy leakage for bit scenarios. This paper designs a novel neuron membership inference attack (NMIA) strategy under semi-honest central servers and bit scenarios, which can compromise DP-FL and obtain client privacy information. Specifically, NMIA generates an inference attack model with low computational overhead by training only in small-scale neurons. The attack model analyzes the gradient outputs of the FL clients and effectively infers information about specific client data. Sufficient conditions for the success of the NMIA have been theoretically proven. To comprehensively evaluate the performance of the NMIA strategy in bit scenarios, two differential privacy protection methods for randomized response encoding applicable to federated learning for bit scenarios (BDP-FL) are proposed. Experimental results show that NMIA can easily defeat traditional DP-FL, achieving an attack accuracy of over 99%, while NMIA’s attack accuracy in bit scenarios is about 20% higher than the existing attack strategies. In addition, NMIA can still defeat the optimized encoding BDP-FL with an attack accuracy of up to 90%, while the symmetric encoding BDP-FL can only mitigate NMIA at the cost of severe FL utility loss.