Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models

TL;DR

This paper provides a theoretical analysis showing that inference attacks can succeed against LDP-protected federated vision models, with practical evaluations confirming significant privacy risks and utility degradation.

Contribution

It derives theoretical lower bounds for attack success rates against LDP in federated learning and demonstrates persistent privacy risks through empirical evaluation.

Findings

Inference attacks remain effective against LDP-protected models.

Higher privacy budgets correlate with increased attack success.

Mitigating attacks with noise reduces model utility significantly.

Abstract

Federated Learning enables collaborative learning among clients via a coordinating server while avoiding direct data sharing, offering a perceived solution to preserve privacy. However, recent studies on Membership Inference Attacks (MIAs) have challenged this notion, showing high success rates against unprotected training data. While local differential privacy (LDP) is widely regarded as a gold standard for privacy protection in data analysis, most studies on MIAs either neglect LDP or fail to provide theoretical guarantees for attack success rates against LDP-protected data. To address this gap, we derive theoretical lower bounds for the success rates of low-polynomial time MIAs that exploit vulnerabilities in fully connected or self-attention layers. We establish that even when data are protected by LDP, privacy risks persist, depending on the privacy budget. Practical evaluations on federated vision models confirm considerable privacy risks, revealing that the noise required to mitigate these attacks significantly degrades models' utility.