Federated Learning is expected to provide strong privacy guarantees, as only gradients or model parameters but no plain text training data is ever exchanged either between the clients or between the clients and the central server. In this paper, we challenge this claim by introducing a simple but still very effective membership inference attack algorithm, which relies only on a single training step. In contrast to the popular honest-but-curious model, we investigate a framework with a dishonest central server. Our strategy is applicable to models with ReLU activations and uses the properties of this activation function to achieve perfect accuracy. Empirical evaluation on visual classification tasks with MNIST, CIFAR10, CIFAR100 and CelebA datasets show that our method provides perfect accuracy in identifying one sample in a training set with thousands of samples. Occasional failures of our method lead us to discover duplicate images in the CIFAR100 and CelebA datasets.

本篇研究介绍了一种针对 relu 激活函数的简单而有效的成员推理攻击算法，通过视觉分类任务对 MNIST、CIFAR10、CIFAR100 和 CelebA 数据集进行实证评估，结果表明，该方法能够在包含数千个样本的训练集中识别一个样本，并偶尔在 CIFAR100 和 CelebA 数据集中发现重复图像。

在联邦学习中，由不诚实的中央服务器完美准确地推断会员身份