Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning

Abstract

Federated learning, i.e., a mobile edge computing framework for deep learning, is a recent advance in privacy-preserving machine learning, where the model is trained in a decentralized manner by the clients, i.e., data curators, preventing the server from directly accessing those private data from the clients. This learning mechanism significantly challenges the attack from the server side. Although the state-of-the-art attacking techniques that incorporated the advance of Generative adversarial networks (GANs) could construct class representatives of the global data distribution among all clients, it is still challenging to distinguishably attack a specific client (i.e., user-level privacy leakage), which is a stronger privacy threat to precisely recover the private data from a specific client. This paper gives the first attempt to explore user-level privacy leakage against the federated learning by the attack from a malicious server. We propose a framework incorporating GAN with a multi-task discriminator, which simultaneously discriminates category, reality, and client identity of input samples. The novel discrimination on client identity enables the generator to recover user specified private data. Unlike existing works that tend to interfere the training process of the federated learning, the proposed method works "invisibly" on the server side. The experimental results demonstrate the effectiveness of the proposed attacking approach and the superior to the state-of-the-art.

arXiv commentThe 38th Annual IEEE International Conference on Computer Communications (INFOCOM 2019)

References in corpus (11)

• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Conditional Image Synthesis With Auxiliary Classifier GANs
• Federated Optimization: Distributed Machine Learning for On-Device Intelligence
• Improved Techniques for Training GANs
• InfoGAN: Interpretable Representation Learning by Information Maximizing Generative Adversarial Nets
• Revisiting Distributed Synchronous SGD
• Differentially Private Federated Learning: A Client Level Perspective
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Proactively Accountable Anonymous Messaging in Verdict
• Learning Privately from Multiparty Data
• LOGAN: Membership Inference Attacks Against Generative Models

Cited by in corpus (6)

• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Free-riders in Federated Learning: Attacks and Defenses
• Attack-Resistant Federated Learning with Residual-based Reweighting
• Implicit Model Specialization through DAG-based Decentralized Federated Learning
• Perfectly Accurate Membership Inference by a Dishonest Central Server in Federated Learning
• Exploiting Defenses against GAN-Based Feature Inference Attacks in Federated Learning