Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Securing Genomic Data Against Inference Attacks in Federated Learning Environments

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a gradient-based membership inference attack can identify whether a synthetic genomic record was in a client's training set, reaching an F1-score of 0.87 in a federated learning setup.

desk verdict The paper's headline G-MIA F1 of 0.87 is not reliable as reported—the threshold is tuned on the evaluation set and the threat model assumes per-sample gradient access that the FedAvg setup does not provide; still, the domain-specific pilot has value if heavily revised. read the letter →

arxiv 2505.07188 v1 pith:HF254RD5 submitted 2025-05-12 cs.CR cs.CL

Chetan Pathade , Shubham Patil This is my paper · ORCID
classification cs.CRcs.CL
keywords FederatedLearningGenomicPrivacyMembershipInferenceAttackGradient-BasedLabelSingleNucleotidePolymorphismsSyntheticDataPrivacy-PreservingMachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a naive federated learning setup for genomic data leaks membership and label information to an honest-but-curious participant. Using 20,000 synthetic single-nucleotide polymorphism (SNP) records split across five clients, the authors run three attacks: confidence-based membership inference, gradient-norm-based membership inference, and label inference. The gradient-based attack achieves precision 0.79 and F1-score 0.87, well above the confidence-based MIA (0.62 F1) and the label attack (0.52 F1). If correct, the result shows that sharing per-sample gradient information in federated genomic training is enough to flag most training records, so standard federated learning without defenses does not protect genomic privacy.

What carries the argument

The load-bearing object is the per-sample gradient norm used as a membership signal. For each input, the model's loss gradient is computed; training members typically show smaller norms because optimization has already moved the model toward them, while non-members show larger norms. A fixed threshold over this norm separates members from non-members, and the same per-sample gradient vectors, flattened, serve as features for the label-inference meta-classifier. The claim that federated genomic learning leaks privacy rests on this measurable separation in gradient space.

What would settle it

Run the same three attacks against a federated setup that communicates only the aggregated global model, with no per-sample gradient logs and no client-side update inspection. If gradient-based membership inference F1 falls to near chance while model accuracy is unchanged, the claim that naive federated learning is inadequate would be falsified; likewise, if per-sample gradients are visible but have been clipped or normalized so that member and non-member gradient norms no longer separate, the 0.87 result should collapse.

Watch

Extended reading notes

Core claim

The central discovery is that, in federated learning over synthetic genomic SNP matrices, an adversary who can see per-sample gradient norms can infer training-set membership almost reliably. Members produce slightly smaller gradient norms than non-members because the model has already fitted them; a fixed threshold on the norm, tuned near 0.45, classifies members with precision 0.79 and recall 0.97, giving F1-score 0.87. The same setup yields precision 0.79 and recall 0.51 for confidence-based membership inference, and precision and recall 0.526 for label inference from per-sample gradient vectors. The authors take this as evidence that naive federated learning does not safeguard genomic data, that gradient exposure is the dominant leak channel, and that explicit defenses are required.

Load-bearing premise

The headline numbers depend on the adversary seeing per-sample gradient norms, an assumption the paper grants in its threat model but that plain federated averaging does not expose, and they are measured only on synthetic SNP data, which the paper's future-work section says needs confirmation on real genomes.

Editorial extensions

If this is right

  • Any federated genomic deployment that exposes per-sample gradient norms should expect membership to be inferable at roughly this success rate: an F1-score of 0.87 means most member records can be flagged with few false negatives.
  • Confidence-based membership inference is weaker but still non-trivial at 0.62 F1, so prediction confidences alone also leak membership even without gradient access.
  • Label inference from gradient statistics beats random guessing (0.526 versus 0.5), meaning disease-status labels can be partially recovered from per-sample gradient information.
  • The three attacks together indicate that a plain federated averaging pipeline, without differential privacy, gradient clipping, or secure aggregation, is not adequate for genomic privacy.
  • Defenses that reduce the gradient-norm separation between members and non-members, such as clipping or noise injection, should be evaluated against these exact attack pipelines.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own future-work section limits the result to synthetic 100-SNP data; confirming the attack on real genomes with linkage disequilibrium and population structure is an untested step.
  • Because the attack is just a threshold over gradient norms, an untested defense follows directly: clipping or normalizing all per-sample gradients to a common magnitude should dissolve the signal the paper identifies.
  • The ranking of attacks suggests a testable extension: run the same three attacks under differential privacy with increasing privacy budget and measure which epsilon pushes gradient-based MIA F1 below 0.7 while preserving model utility.
  • The paper treats each attack separately, but a combined adversary who uses both confidence scores and gradient norms could plausibly exceed any single attack's F1-score; the paper does not test this combination.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper reports an empirical evaluation of three inference attacks—Membership Inference Attack (MIA), Gradient-Based MIA (G-MIA), and Label Inference Attack (LIA)—against a federated learning pipeline trained on 20,000 synthetic genomic SNP records with a binary phenotype label. The experiments use Flower with FedAvg over five clients, and the paper's headline result is that G-MIA achieves precision 0.79, recall 0.97, and F1-score 0.87 (Abstract, Table I). The authors conclude that naive federated learning is inadequate for genomic privacy and propose defense directions including differential privacy, gradient obfuscation, and secure aggregation. The claimed contribution is a domain-specific, reproducible evaluation of inference attacks in genomic FL.

Significance. If the headline result were valid, the paper would provide a useful quantitative warning about gradient-based membership leakage in genomic federated learning, a domain where privacy stakes are high and empirical attack evaluations are relatively scarce. The paper is clearly written, includes a well-structured threat model (Section IV), and uses a standard FL framework (Flower) with a realistic synthetic SNP data format. However, the central empirical claim is undermined by a mismatch between the threat model and the simulated protocol, and by the absence of a valid calibration procedure for the attack threshold. As it stands, the reported 0.87 F1-score cannot be interpreted as a deployable attack success rate. The paper does not include machine-checked proofs, reproducible code, or parameter-free derivations; its value would depend entirely on the empirical results being trustworthy and generalizable.

major comments (4)
  1. [Section IV vs. Sections VI.2, VI.3] The threat model grants the adversary access only to its own local gradients and the global model updates, not to per-sample gradients of other clients (Section IV, 'Gradient Visibility'). However, Gradient-Based MIA and LIA are implemented using 'per-sample gradient norms' and 'per-sample gradient vectors' (Section VI.3). In the simulated FedAvg protocol (Section VI.2), clients exchange only aggregated model parameters with the server, so the attacker never observes another client's per-sample gradients. This is a load-bearing inconsistency: the headline F1=0.87 for G-MIA is not a valid demonstration of vulnerability in the system the authors simulate. The authors must either align the attack with the actual information available (e.g., using only global model snapshots) or explicitly expand the threat model (e.g., to a malicious server that can access per-sample gradients).
  2. [Section VII.4, Table I] The gradient norm threshold for G-MIA is described as 'empirically tuned' (Section VII.4), and the text reports a specific value of 0.45, while Table I presents precision 0.79, recall 0.97, F1 0.87 as the attack's performance. No held-out calibration set, cross-validation, or procedure for selecting the threshold independently of the membership labels is described. Since an attacker in a real membership inference scenario does not know the membership ground truth for the target samples, the reported numbers are an optimistic upper bound obtained by choosing the best threshold on the evaluation set. The authors should report the attack performance with a threshold selected on the attacker's known local data, and quantify the sensitivity of the results to the threshold choice.
  3. [Section VII (Evaluation Metrics & Results)] Table I reports a single set of precision, recall, and F1 values with no error bars, standard deviations, or multiple runs. The text in Section VIII claims the attacks 'achieve alarming levels of success' and that G-MIA 'reliably' infers nearly all training points, but with one fixed-seed simulation there is no statistical support for the generality or stability of these conclusions. The paper should report results over multiple random seeds or data partitions, and at least provide confidence intervals for the headline metrics.
  4. [Section VI.3, LIA description] The LIA description states that a meta-classifier is trained on 'per-sample gradient vectors' from labeled samples and tested on unknown samples. Beyond the threat-model feasibility problem noted above, the description lacks essential implementation details: what is the train/test split of this meta-classifier, how are the gradient vectors obtained for the 'unknown samples,' and what is the baseline for the reported 0.526 precision? Without this information, the LIA result cannot be reproduced or interpreted.
minor comments (5)
  1. [Section V, Dataset Description] Section V first describes the dataset as 'synthesized,' but Section VI.1 calls it 'a curated and anonymized genomic dataset' and Section VIII refers to 'synthetic genomic data.' Please clarify the data provenance and generation procedure, including how the 100 SNP values and the binary label were simulated.
  2. [Section VI.3 vs. Section VII.4] Section VI.3 states that 'a fixed threshold (e.g., 0.5)' was used for G-MIA, while Section VII.4 reports the empirically tuned value 0.45. This discrepancy should be reconciled, and the threshold should be explicitly connected to the results in Table I.
  3. [References] Several references contain errors or are incomplete; for example, [27] cites 'The Federation Strikes Back' with the arXiv identifier 1610.05820, which is the Shokri et al. membership inference paper, and [31] repeats the same arXiv number. Please verify all bibliographic entries.
  4. [Figure 7 caption] The caption of Figure 7 contains a typo: 'Comaprison' should be 'Comparison.'
  5. [Reproducibility] The paper claims a 'reproducible FL setup' but provides no code repository, random seed values, or detailed hyperparameter listing (e.g., learning rate, number of clients in the figure). The authors should make the simulation scripts and attack code publicly available to support the reproducibility claim.

Circularity Check

1 steps flagged · score 4.0 of 10

Gradient-MIA's headline 0.87 F1 is partly an artifact of in-sample threshold tuning; otherwise the paper is a self-contained empirical evaluation.

  1. fitted input called prediction [Section VI.3 (Attack Implementation) and Section VII.4 (Gradient Norm Threshold); Table I]
    "Gradient norms were computed per sample. A fixed threshold (e.g., 0.5) was used to classify samples as members or non-members. ... We empirically tuned this parameter (e.g., 0.45) and analyzed its impact on attack performance."

    The paper's central quantitative result, G-MIA F1 = 0.87 (Table I), is computed after 'empirically tun[ing]' the gradient-norm threshold. No held-out calibration set or cross-validation is described; the threshold selection and the precision/recall/F1 computation use the same membership-labeled data. Because the attacker in a real membership inference setting does not know the target samples' membership labels, choosing the threshold to optimize performance on the evaluation set yields an upper bound, not a deployable attack success rate. The reported attack effectiveness is therefore partly a function of the fitted threshold rather than an independent measurement.

full rationale

This paper is an empirical attack evaluation, not a derivation, so there is no equation-level circularity and no load-bearing self-citation: the cited GBMIA, Nasr, Shokri, and related works are external prior art. The only circularity-adjacent issue is the Gradient-Based MIA threshold: the paper states that a fixed threshold was used (Section VI.3) but then reports that it 'empirically tuned this parameter (e.g., 0.45)' (Section VII.4) and presents the resulting F1 = 0.87 as the attack's effectiveness. Since no calibration set is described, the headline G-MIA number is consistent with in-sample threshold optimization, making the attack's reported success partly an artifact of evaluation-set tuning rather than a fully independent prediction. The central claim that gradient exposure leaks membership retains independent support from the observed separation in gradient-norm distributions and from prior external work, so the circularity is partial rather than complete. Overall score 4.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper's central result rests on a tuned gradient threshold, an assumed per-sample gradient exposure, and an undescribed synthetic dataset. There are no new theoretical entities. The main free parameter is the gradient-norm threshold, which directly determines the reported attack success.

free parameters (2)
  • Gradient norm threshold for Gradient-Based MIA = Not uniquely stated; text mentions 0.5 in Section VI and 0.45 in Section VII.
    The paper says the threshold was empirically tuned after observing member and non-member gradient norms; this directly controls the reported 0.97 recall and 0.87 F1.
  • MIA confidence threshold = Not stated.
    The confidence-based MIA implementation is described only as analyzing model confidence on member versus non-member data; a decision threshold is required but not reported.
assumptions (4)
  • domain assumption Training samples produce smaller gradient norms than non-members, enabling gradient-based membership inference.
    Stated in Section VI.3 as the attack rationale and illustrated in Figure 1, but the overlap is not quantified and the threshold is then fitted to this distribution.
  • domain assumption The adversary has access to per-sample gradients even though the federated protocol exchanges aggregated model updates.
    Section IV grants 'Gradient Visibility' to the attacker; this is a white-box assumption that a standard Flower FedAvg deployment does not provide, so the headline attack may not apply to real FL.
  • domain assumption The synthetic dataset of 20,000 samples and 100 SNP features approximates real genomic data closely enough to draw privacy conclusions.
    Section V says the data was synthesized to simulate realistic distributions but gives no generator, so the assumption is unverified.
  • domain assumption No feature normalization is appropriate because it preserves gradient magnitudes for the attack.
    Section VI.1 deliberately skips normalization; real genomic pipelines often standardize features, which would change gradient norms and likely alter attack success.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing Genomic Data Against Inference Attacks in Federated Learning Environments." pith.science (2026). https://pith.science/paper/HF254RD5

@misc{pith2026250507188,
  author       = {Pith},
  title        = {Pith review of: Securing Genomic Data Against Inference Attacks in Federated Learning Environments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HF254RD5}},
  note         = {Machine review of arXiv:2505.07188}
}
read the original abstract

Federated Learning (FL) offers a promising framework for collaboratively training machine learning models across decentralized genomic datasets without direct data sharing. While this approach preserves data locality, it remains susceptible to sophisticated inference attacks that can compromise individual privacy. In this study, we simulate a federated learning setup using synthetic genomic data and assess its vulnerability to three key attack vectors: Membership Inference Attack (MIA), Gradient-Based Membership Inference Attack, and Label Inference Attack (LIA). Our experiments reveal that Gradient-Based MIA achieves the highest effectiveness, with a precision of 0.79 and F1-score of 0.87, underscoring the risk posed by gradient exposure in federated updates. Additionally, we visualize comparative attack performance through radar plots and quantify model leakage across clients. The findings emphasize the inadequacy of na\"ive FL setups in safeguarding genomic privacy and motivate the development of more robust privacy-preserving mechanisms tailored to the unique sensitivity of genomic data.

Figures

Figures reproduced from arXiv: 2505.07188 by the authors.

Figure 2
Figure 2. PCA Scatter Plot of SNPs By Label These subtle variations are sufficient for inference attacks to distinguish patterns, particularly when combined with model gradients or output confidences. Top 10 SNP Correlations with Label To quantify how strongly individual SNPs correlate with the phenotype label, we computed Pearson correlation coefficients between each SNP and the label. The chart below shows the 10 SNPs with … view at source ↗
Figure 3
Figure 3. Top 10 SNP Correlations With Label Although these correlations are weak (as expected in realistic genomic data), their cumulative effect can contribute to effective leakage in federated settings. Summary Statistics • Samples: 20,000 • Features: 100 SNPs • Labels: Binary (0 or 1) • Missing Values: None • Data Type: Integer (for SNPs), Binary Integer (for label) This dataset thus provides a strong foundation for evalu… view at source ↗
Figure 4
Figure 4. Federated Learning Architecture [47] • Local Model Architecture: – Each client used a SGDClassifier from scikit￾learn with loss=’log loss’ to perform binary clas￾sification. – The model was initialized using a fixed random seed and trained using the partial fit method, which supports incremental training. • Training Configuration: – Number of Communication Rounds: 10 – Local Epochs per Round: 1 – Batch Size: Full ba… view at source ↗
Figures from the paper (2 more)
Figure 6
Figure 6. Figure 6: Attack Performance Comparison Each attack—Membership Inference Attack (MIA), Gradient-Based MIA, and Label Inference Attack (LIA)-is evaluated on the following criteria: 1) Precision (Positive Predictive Value) Precision measures the proportion of samples predicted as …
Figure 7
Figure 7. Figure 7: Comaprison of Attack Techniques • PCA Projections: Scatter plots of SNP data in 2D after dimensionality reduction highlight the sepa￾rability of samples and potential leakage of label patterns. • Pearson Correlation Bars: Show the correlation between individual SNP fea…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Exposing Hidden Backdoors in NFT Smart Contracts: A Static Security Analysis of Rug Pull Patterns

    cs.CR 2025-06 reject novelty 3.0 of 10

    A static analysis of nearly 50,000 Ethereum NFT contracts finds that 22.6% contain multiple rug-pull-related code patterns, though the study does not validate these flags against confirmed scams.

Reference graph

Works this paper leans on

48 extracted references · 32 canonical work pages · cited by 1 Pith paper

  1. [1]

    ”Recent Advances on Feder- ated Learning: A Systematic Survey” arXiv preprint arXiv:2301.01299 (2023)

    Bingyan Liu and Nuoyan Lv, et al. ”Recent Advances on Feder- ated Learning: A Systematic Survey” arXiv preprint arXiv:2301.01299 (2023)

    arXiv 2023

  2. [2]

    A Survey for Federated Learning Evaluations: Goals and Measures

    Di Chai and Leye Wang, et al. ”A Survey for Federated Learning Evaluations: Goals and Measures” arXiv preprint arXiv:2308.11841 (2024)

    work page Pith review arXiv 2024

  3. [3]

    Brendan McMahan and Eider Moore, et al

    H. Brendan McMahan and Eider Moore, et al. ”Communication-Efficient Learning of Deep Networks from Decentralized Data.” arXiv preprint arXiv:1602.05629 (2023)

    arXiv 2023

  4. [5]

    ”GBMIA: Gradient-based Mem- bership Inference Attack in Federated Learning” ICC 2023 - IEEE International Conference on Communications

    Wang, Xiaodong and Wang, et al. ”GBMIA: Gradient-based Mem- bership Inference Attack in Federated Learning” ICC 2023 - IEEE International Conference on Communications

    work page 2023

  5. [6]

    Raimondi, D., Chizari, H., et al. ”Genome interpretation in a federated learning context allows the multi-center exome-based risk prediction of Crohn’s disease patients” https://www.nature.com/articles/s41598-023- 46887-2

    work page

  6. [7]

    ”Subject Membership Infer- ence Attacks in Federated Learning” arXiv preprint arXiv:2206.03317 (2023)

    Anshuman Suri and Pallika Kanani, et al. ”Subject Membership Infer- ence Attacks in Federated Learning” arXiv preprint arXiv:2206.03317 (2023)

    arXiv 2023

  7. [8]

    ”Label Inference Attacks Against Vertical Federated Learning” 31st USENIX Security Symposium (USENIX Security 22)

    Chong Fu, et al. ”Label Inference Attacks Against Vertical Federated Learning” 31st USENIX Security Symposium (USENIX Security 22)

    work page

  8. [9]

    Yin, Xuefei and Zhu, Yanming, et al. ”A Comprehensive Sur- vey of Privacy-preserving Federated Learning: A Taxonomy, Re- view, and Future Directions” Association for Computing Machinery https://dl.acm.org/doi/10.1145/3460427

    doi:10.1145/3460427

Show all 48 references
  1. [10]

    ”Efficacy of federated learning on genomic data: a study on the UK Biobank and the 1000 Genomes Project” Frontiers in Big Data

    Kolobkov D, Mishra Sharma S, et al. ”Efficacy of federated learning on genomic data: a study on the UK Biobank and the 1000 Genomes Project” Frontiers in Big Data

  2. [11]

    ”Active Membership Inference Attack under Local Differential Privacy in Federated Learning” arXiv preprint arXiv:2302.12685 (2023)

    Truc Nguyen and Phung Lai, et al. ”Active Membership Inference Attack under Local Differential Privacy in Federated Learning” arXiv preprint arXiv:2302.12685 (2023)

    2023 arXiv

  3. [12]

    ”Federated Learning: Breaking Down Barriers in Global Genomic Research” Genes

    Calvino, Giulia and Cristina Peconi, et al. ”Federated Learning: Breaking Down Barriers in Global Genomic Research” Genes. 2024; 15(12):1650. https://doi.org/10.3390/genes15121650

    2024 doi

  4. [13]

    ”Federated Analysis for Privacy-Preserving Data Sharing: A Technical and Legal Primer.” Annu Rev Genomics Hum Genet

    Casaletto J, Bernier A, et al. ”Federated Analysis for Privacy-Preserving Data Sharing: A Technical and Legal Primer.” Annu Rev Genomics Hum Genet. 2023 May 30;24:347–368. doi: 10.1146/annurev-genom-110122- 084756

    2023 doi

  5. [14]

    ”Genome interpretation in a federated learning context allows the multi-center exome-based risk prediction of Crohn’s disease patients” Sci Rep 13, 19449 (2023)

    Daniele Raimondi and Haleh Chizari, et al. ”Genome interpretation in a federated learning context allows the multi-center exome-based risk prediction of Crohn’s disease patients” Sci Rep 13, 19449 (2023). https://doi.org/10.1038/s41598-023-46887-2

    2023 doi

  6. [15]

    ”Privacy Preserving Feder- ated Learning in Medical Imaging with Uncertainty Estimation” arXiv preprint arXiv:2406.12815 (2024)

    Nikolas Koutsoubis and Yasin Yilmaz, et al. ”Privacy Preserving Feder- ated Learning in Medical Imaging with Uncertainty Estimation” arXiv preprint arXiv:2406.12815 (2024)

    2024 arXiv

  7. [16]

    Nasr, Milad et al. ”Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning”2019 IEEE Symposium on Security and Privacy (SP) http://dx.doi.org/10.1109/SP.2019.00065

    2019

  8. [18]

    ”Security and Privacy Issues of Federated Learning” arXiv preprint arXiv:2307.12181 (2023)

    Jahid Hasan. ”Security and Privacy Issues of Federated Learning” arXiv preprint arXiv:2307.12181 (2023)

    2023 arXiv

  9. [19]

    ”More than Enough is Too Much: Adaptive Defenses against Gradient Leakage in Production Federated Learning” IEEE INFOCOM 2023

    Fei Wang, Ethan Hugh, et al. ”More than Enough is Too Much: Adaptive Defenses against Gradient Leakage in Production Federated Learning” IEEE INFOCOM 2023

    2023

  10. [20]

    ”Generalized genomic data sharing for differentially private federated learning” J Biomed Inform

    Aziz MMA, Anjum MM et al. ”Generalized genomic data sharing for differentially private federated learning” J Biomed Inform. 2022

    2022

  11. [21]

    ”Re-identification of individuals in genomic datasets using public face images” American Association for the Advancement of Science (AAAS) http://dx.doi.org/10.1126/sciadv.abg3296

    Venkatesaramani, Rajagopal, et al. ”Re-identification of individuals in genomic datasets using public face images” American Association for the Advancement of Science (AAAS) http://dx.doi.org/10.1126/sciadv.abg3296

    doi

  12. [22]

    ”Identifying personal genomes by surname inference.” Science

    Gymrek M, McGuire AL, et al. ”Identifying personal genomes by surname inference.” Science. 2013 Jan 18;339(6117):321-4. doi: 10.1126/science

    2013 doi

  13. [23]

    Kokje, Y . (2020). ”Privacy Preserving Framework for Federated Learn- ing in Genomics”. MIT DSpace

    2020

  14. [24]

    ”ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models” arXiv preprint arXiv:1806.01246 (2018)

    Ahmed Salem and Yang Zhang, et al. ”ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models” arXiv preprint arXiv:1806.01246 (2018)

    2018 arXiv

  15. [25]

    ”Privacy and Security in Fed- erated Learning: A Survey” Applied Sciences 12, no

    Gosselin, R ´emi and Lo ¨ıc Vieu, et al. ”Privacy and Security in Fed- erated Learning: A Survey” Applied Sciences 12, no. 19: 9901. https://doi.org/10.3390/app12199901

    doi

  16. [26]

    ”Privacy in Federated Learning” http://dx.doi.org/10.5772/intechopen.1003421

    Jaydip Sen, et al. ”Privacy in Federated Learning” http://dx.doi.org/10.5772/intechopen.1003421

    doi

  17. [27]

    ”The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape.” arXiv preprint arXiv:1610.05820 (2017)

    Zhao Joshua and Bagchi Saurabh, et al. ”The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape.” arXiv preprint arXiv:1610.05820 (2017). Association for Computing Machinery (ACM) http://dx.doi.org/10.1145/3724113

    2017 arXiv

  18. [28]

    ”When the Curious Abandon Honesty: Federated Learning Is Not Private.” arXiv preprint arXiv:2112.02918 (2023)

    Franziska Boenisch and Adam Dziedzic, et al. ”When the Curious Abandon Honesty: Federated Learning Is Not Private.” arXiv preprint arXiv:2112.02918 (2023)

    2023 arXiv

  19. [29]

    ”A Novel Model-Based Attribute Inference Attack in Federated Learning.” OpenReview https://openreview.net/forum?id=jJx00vsVVSF

    Ilias Driouich and Chuan Xu, et al. ”A Novel Model-Based Attribute Inference Attack in Federated Learning.” OpenReview https://openreview.net/forum?id=jJx00vsVVSF

  20. [30]

    Brendan, et al

    Peter Kairouz and H. Brendan, et al. ”Advances and Open Problems in Federated Learning.” arXiv preprint arXiv:1912.04977 (2021)

    2021 arXiv

  21. [31]

    ”GBMIA: Gradient-based Membership Inference Attack in Federated Learning” ICC 2023 - IEEE International Conference on Communications

    Xiaodong Wang and Naiyu Wang, et al. ”GBMIA: Gradient-based Membership Inference Attack in Federated Learning” ICC 2023 - IEEE International Conference on Communications

    2023

  22. [32]

    ”Membership Inference Attacks and Defenses in Federated Learning: A Survey” arXiv preprint arXiv:2412.06157 (2024)

    Li Bai and Haibo Hu, et al. ”Membership Inference Attacks and Defenses in Federated Learning: A Survey” arXiv preprint arXiv:2412.06157 (2024)

    2024 arXiv

  23. [33]

    ”Robust Federated Learning Mitigates Client-side Training Data Distribution Inference Attacks.” arXiv preprint arXiv:2403.03149 (2024)

    Yichang Xu and Ming Yin et al. ”Robust Federated Learning Mitigates Client-side Training Data Distribution Inference Attacks.” arXiv preprint arXiv:2403.03149 (2024)

    2024 arXiv

  24. [34]

    Shukla, S., Rajkumar, S., Sinha, A. et al. ”Federated learning with differential privacy for breast cancer diagnosis enabling se- cure data sharing and model integrity.” Sci Rep 15, 13061 (2025). https://doi.org/10.1038/s41598-025-95858-2

    2025 doi

  25. [35]

    ”Differential Privacy Protection Against Membership Inference Attack on Machine Learning for Genomic Data.” Pac Symp Biocomput

    Chen J, Wang WH, Shi X. ”Differential Privacy Protection Against Membership Inference Attack on Machine Learning for Genomic Data.” Pac Symp Biocomput. 2021;26:26-37. PMID: 33691001

    2021

  26. [36]

    ”Gradient Obfuscation Gives a False Sense of Security in Federated Learning” arXiv preprint arXiv:2206.04055 (2022)

    Kai Yue and Richeng Jin et al. ”Gradient Obfuscation Gives a False Sense of Security in Federated Learning” arXiv preprint arXiv:2206.04055 (2022)

    2022 arXiv

  27. [37]

    ”Practical Secure Ag- gregation for Privacy-Preserving Machine Learning” Association for Computing Machinery, https://doi.org/10.1145/3133956.3133982

    Bonawitz Keith and Ivanov Vladimir et al. ”Practical Secure Ag- gregation for Privacy-Preserving Machine Learning” Association for Computing Machinery, https://doi.org/10.1145/3133956.3133982

  28. [38]

    Smajlovi ´c, H., Shajii, A., Berger, B. et al. ”Sequre: a high-performance framework for secure multiparty computation enables biomedical data sharing.” Genome Biol 24, 5 (2023). https://doi.org/10.1186/s13059-022- 02841-5

    2023 doi

  29. [39]

    Yang, J., Soltan, A.A.S., Eyre, D.W. et al. ”An adversarial training framework for mitigating algorithmic biases in clinical machine learn- ing.” npj Digit. Med. 6, 55 (2023). https://doi.org/10.1038/s41746-023- 00805-y

    2023 doi

  30. [40]

    ”SoK: Secure Aggregation based on cryp- tographic schemes for Federated Learning.” PETS 2023, 23rd Pri- vacy Enhancing Technologies Symposium, IACR, Jul 2023, Lausanne, Switzerland

    Mohamad Mansouri, et al. ”SoK: Secure Aggregation based on cryp- tographic schemes for Federated Learning.” PETS 2023, 23rd Pri- vacy Enhancing Technologies Symposium, IACR, Jul 2023, Lausanne, Switzerland

    2023

  31. [41]

    D’Altri, T., Freeberg, M.A., Curwin, A.J. et al. ”The Feder- ated European Genome–Phenome Archive as a global network for sharing human genomics data.” Nat Genet 57, 481–485 (2025). https://doi.org/10.1038/s41588-025-02101-9

    2025 doi

  32. [42]

    ”Democratizing clinical-genomic data: How federated platforms can promote benefits sharing in ge- nomics.” Frontiers in Genetics

    Alvarellos M and Sheppard HE, et al. ”Democratizing clinical-genomic data: How federated platforms can promote benefits sharing in ge- nomics.” Frontiers in Genetics

  33. [43]

    ”Federated Learning on Transcriptomic Data: Model Quality and Performance Trade-Offs” arXiv preprint arXiv:2402.14527 (2024)

    Anika Hannemann, et al. ”Federated Learning on Transcriptomic Data: Model Quality and Performance Trade-Offs” arXiv preprint arXiv:2402.14527 (2024)

    2024 arXiv

  34. [44]

    ”Technical Insights and Legal Considerations for Advancing Federated Learning in Bioinformatics.” arXiv preprint arXiv:2503.09649 (2025)

    Daniele Malpetti and Marco Scutari, et al. ”Technical Insights and Legal Considerations for Advancing Federated Learning in Bioinformatics.” arXiv preprint arXiv:2503.09649 (2025)

    2025

  35. [45]

    ”Differentially Private Feder- ated Learning for Cancer Prediction” arXiv preprint arXiv:2101.02997 (2021)

    Constance Beguier and Jean Ogier, et al. ”Differentially Private Feder- ated Learning for Cancer Prediction” arXiv preprint arXiv:2101.02997 (2021)

    2021 arXiv

  36. [46]

    K., Talwalkar, A., & Smith, V

    Li, T., Sahu, A. K., Talwalkar, A., & Smith, V . (2020). ”Federated Learn- ing: Challenges, Methods, and Future Directions.” IEEE Signal Process- ing Magazine, 37(3), 50–60. https://doi.org/10.1109/MSP.2020.2975749

    2020

  37. [47]

    ”In the Jungle of Federated Learning Frameworks” https://flower.ai/blog/2024-07-22-fl-frameworks-comparison/

    Pascal Riedel. ”In the Jungle of Federated Learning Frameworks” https://flower.ai/blog/2024-07-22-fl-frameworks-comparison/

    2024

  38. [48]

    ”Over-the-Air Membership In- ference Attacks as Privacy Threats for Deep Learning-based Wireless Signal Classifiers” arXiv preprint arXiv:2006.14576 (2020)

    Yi Shi and Kemal Davaslioglu, et al. ”Over-the-Air Membership In- ference Attacks as Privacy Threats for Deep Learning-based Wireless Signal Classifiers” arXiv preprint arXiv:2006.14576 (2020)

    2020 arXiv

  39. [49]

    https://en.wikipedia.org/wiki/Precision and recall

    Precision and Recall. https://en.wikipedia.org/wiki/Precision and recall

  40. [50]

    https://en.wikipedia.org/wiki/F-score

    F-Score. https://en.wikipedia.org/wiki/F-score

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.