Label Inference Attacks against Federated Unlearning

TL;DR

This paper introduces ULIA, a novel label inference attack against federated unlearning, demonstrating high success rates in inferring data labels across different unlearning levels and data distributions.

Contribution

The paper proposes ULIA, the first label inference attack against federated unlearning, with a gradient-label mapping mechanism to effectively infer unlearning data labels.

Findings

UILA achieves 100% attack success rate in IID settings.

UILA attains 93% to 62.3% success when only 1% data is forgotten.

The attack is effective across different unlearning levels and data distributions.

Abstract

Federated Unlearning (FU) has emerged as a promising solution to respond to the right to be forgotten of clients, by allowing clients to erase their data from global models without compromising model performance. Unfortunately, researchers find that the parameter variations of models induced by FU expose clients' data information, enabling attackers to infer the label of unlearning data, while label inference attacks against FU remain unexplored. In this paper, we introduce and analyze a new privacy threat against FU and propose a novel label inference attack, ULIA, which can infer unlearning data labels across three FU levels. To address the unique challenges of inferring labels via the models variations, we design a gradient-label mapping mechanism in ULIA that establishes a relationship between gradient variations and unlearning labels, enabling inferring labels on accumulated model variations. We evaluate ULIA on both IID and non-IID settings. Experimental results show that in the IID setting, ULIA achieves a 100% Attack Success Rate (ASR) under both class-level and client-level unlearning. Even when only 1% of a user's local data is forgotten, ULIA still attains an ASR ranging from 93% to 62.3%.