Federated learning (FL) was originally regarded as a framework for collaborative learning among clients with data privacy protection through a coordinating server. In this paper, we propose a new active membership inference (AMI) attack carried out by a dishonest server in FL. In AMI attacks, the server crafts and embeds malicious parameters into global models to effectively infer whether a target data sample is included in a client's private training data or not. By exploiting the correlation among data features through a non-linear decision boundary, AMI attacks with a certified guarantee of success can achieve severely high success rates under rigorous local differential privacy (LDP) protection; thereby exposing clients' training data to significant privacy risk. Theoretical and experimental results on several benchmark datasets show that adding sufficient privacy-preserving noise to prevent our attack would significantly damage FL's model utility.

本文提出了一种新的利用非线性决策边界来进行攻击的Federated learning中的主动成员推断（AMI）攻击方式，可以在强烈的本地差分隐私（LDP）的保护下获得高成功率。我们的理论和实验结果表明，为了防止这种攻击，加入足够的隐私保护噪声将会严重损害FL的模型效用。

联邦学习中基于局部差分隐私的主动成员推断攻击