Pith. sign in

REVIEW 3 major objections 6 minor 50 references

Unveiling Client Privacy Leakage from Public Dataset Usage in Federated Distillation

T0 review · 3 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper shows that a server with only black-box access to client models in public-dataset-assisted federated distillation can infer clients' private label distributions and detect training-set membership.

desk verdict The label-distribution attack is a clean, useful result; the membership-inference numbers are confounded by public-dataset exposure and need a control before being read as private-data leakage. read the letter →

arxiv 2502.08001 v2 pith:YFCS2BZG submitted 2025-02-11 cs.CR cs.LG

Haonan Shi , Tu Ouyang , An Wang This is my paper · ORCID
classification cs.CRcs.LG
keywords federateddistillationmembershipinferenceattacklabeldistributionlikelihoodratiohonest-but-curiousserverpublicdatasetlearningprivacyknowledge
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Public-dataset-assisted federated distillation (PDA-FD) is designed so clients share only inference outputs on a public dataset, not their private data. This paper tries to establish that this design still leaks private information: an honest-but-curious server that chooses the public dataset and reads clients' inference results can estimate the label distribution of a client's private training set, and can also run membership inference to tell whether a given sample was in that training set. The authors propose two membership-inference methods built on likelihood-ratio testing, one using other clients as reference models and one using student models distilled from the target client. Across FedMD, DS-FL, and Cronus, the attacks achieve non-trivial success, with the strongest membership attack reaching about 36% true positive rate at 1% false positive rate on CIFAR-10. If correct, this shows that the privacy advantage of distillation-based federated learning is smaller than commonly assumed.

What carries the argument

The machinery is likelihood-ratio testing over prediction confidences, adapted to federated distillation. Given a candidate sample, the attacker transforms each model's posterior probability for its label through the logit $\phi(f_\theta(x)_y)=\log(f_\theta(x)_y/(1-f_\theta(x)_y))$, fits a Gaussian to those values across reference models, and flags the sample as a member if the target model's transformed confidence lies far in the upper tail. The paper's contribution is how it obtains reference models without a shadow dataset: either by selecting other clients whose inferred label distributions are close to the target's, or by knowledge-distilling several student models from the target client using the public dataset. The label-distribution attack is the prerequisite that makes the first route work and is itself carried by the observation that neural networks trained on a skewed private set keep assigning elevated probabilities to the over-represented classes.

What would settle it

Run a PDA-FD deployment in which the server cannot add its own samples to the public dataset and the public data shares no classes or distribution with the target client's private data; if membership inference still yields true positive rates clearly above random guessing at 1% false positive rate, the paper's proposed mechanism would be wrong. A more direct check is to remove the server's ability to insert target samples while keeping everything else identical, and observe whether distillation-based LiRA TPR at 1% FPR collapses to the random baseline.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is a simple leakage mechanism: a client model trained on a private dataset carries that dataset's label distribution into its predictions, so averaging the softmax outputs over a class-balanced public inference set, $\hat p = \frac{1}{|D_{\text{inf}}|}\sum_{x\in D_{\text{inf}}}\operatorname{softmax}(z_\theta(x))$, recovers a close estimate of the training label distribution. The same overfitting that enables this also enables membership inference, and the paper shows that the standard likelihood-ratio attack can be adapted to the black-box, no-shadow-dataset setting of PDA-FD: Co-op LiRA uses other clients whose inferred label distributions are close to the target's as reference models, while Distillation-based LiRA trains student models from the target client's outputs on the public dataset and uses those students as references. The paper reports that these methods outperform existing federated-distillation membership attacks and reach their best results under more uniform label distributions, with distillation-based LiRA reaching a TPR of 35.76% at 1% FPR on CIFAR-10 under DS-FL with $\alpha=10$.

Load-bearing premise

The attacks assume the server can put the specific samples it wants to test into the public dataset and have all clients run inference on them; if a server cannot obtain or insert candidate target samples, the membership inference attack has nothing to test.

Editorial extensions

If this is right

  • If the server controls which public samples are queried, then any sample it can insert into the public set becomes testable for membership in every client's private data, without the server ever seeing model weights.
  • Across the three frameworks studied, larger public datasets leak more: increasing the public subset from 5,000 to 10,000 samples raises distillation-based LiRA TPR at 1% FPR from 29.28% to 32.01% and lowers LDIA KL divergence from 0.10 to 0.07.
  • Attack success depends on data distribution: more uniform client label distributions make both LDIA and MIA more effective, while highly imbalanced distributions degrade membership inference even when the label-distribution estimate remains informative.
  • Distillation-based LiRA remains partially effective even when public and private datasets come from different domains, although larger distribution shifts weaken both the attack and the federated distillation itself.
  • Existing defenses are only partial: DP-SGD with a small privacy budget cuts the membership attack's TPR at 1% FPR to about 1.3% on CIFAR-10, but the label-distribution attack still yields a KL divergence around 0.10.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The attacks' practical reach depends on an assumption the paper grants rather than quantifies: the server must be able to place candidate target samples into the public dataset. In deployments where the server cannot source or insert such samples, the membership-inference half of the threat would largely collapse, while the label-distribution attack would survive.
  • The same leakage mechanism likely extends beyond the three frameworks tested to any PDA-FD variant that asks clients to run inference on server-chosen public data, since the attack only needs the exchanged logits and a class-balanced query set. This is an extrapolation, not a result of the paper.
  • A testable defense follows from the mechanism: if the public query set is fixed by an external party or chosen without the server's involvement, and if client outputs are perturbed or rounded before transmission, both LDIA and distillation-based LiRA should degrade; the paper does not evaluate this setting.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper analyzes privacy risks in public dataset-assisted federated distillation (PDA-FD) frameworks, specifically FedMD, DS-FL, and Cronus, under an honest-but-curious server. The authors propose a label distribution inference attack (LDIA) that averages softmax outputs over a class-balanced public subset (Eq. 4), and two membership inference attacks based on the likelihood ratio attack (LiRA): Co-op LiRA, which uses other clients' models with similar inferred label distributions as reference models, and Distillation-based LiRA, which distills student models from the target client's outputs on the public dataset. The attacks are evaluated on CIFAR-10, CINIC-10, Fashion-MNIST, Purchase, and a public-private distribution-shift setting, with ablations on public dataset size, number of reference models, distribution shift, DP-SGD, and evasive clients.

Significance. The paper is the first comprehensive server-side privacy analysis of PDA-FD. The LDIA is conceptually simple and achieves substantially lower KL divergence than a random baseline across frameworks. The LiRA adaptation is methodologically sound, and the honest reporting of weak results on Fashion-MNIST and Purchase is a strength. However, the validity of the MIA results depends on resolving the confound between private membership and public knowledge-distillation exposure, which is not controlled in the current experiments. If that confound is resolved, the paper would be a valuable contribution to the privacy literature on federated distillation.

major comments (3)
  1. [Section 3.3, Algorithm 2; Algorithm 1 line 12] In Algorithm 2 (lines 3-4), the server inserts the target candidate sample (x,y) into the public dataset D_pub and sends D_pub to all clients. Because the PDA-FD protocol uses every communication-phase public sample as a knowledge-distillation training input (Algorithm 1, line 12), the target model and all other clients are trained on (x,y) through the public channel regardless of whether (x,y) is in the target client's private dataset. In Co-op LiRA, the other clients' models are therefore not valid 'out' models after the first round; in Distillation-based LiRA, the student models are trained on D_pub \ {(x,y)} while the target model has the extra public-KD exposure. The measured target-versus-reference discrepancy thus conflates private membership with public-KD exposure. Section 4.3 (Different PDA-FD Frameworks) explicitly states that this initial exposure 'still impacts the server's MIA results,' yet no control experiment (e.g., inserting non-members into D_pub and measuring the same discrepancy, or training a target model without the inserted public samples) is provided. Without such a control, the reported TPR at 1% FPR in Tables 4 and 5 cannot be attributed solely to leakage of private membership.
  2. [Section 3.1] Section 3.1 states that the honest-but-curious server 'is not allowed to modify the learning process or affect the performance of FD training.' However, the proposed attacks directly modify the learning process by inserting attacker-chosen samples into D_pub, which changes the KD training data for every client. The paper provides no measurement of the utility impact of this insertion (e.g., a comparison of federated accuracy with and without the inserted target samples). The claim that the attacks are compatible with the stated threat model is therefore unsupported. The authors should either relax the threat model to an 'active' server or demonstrate empirically that insertion does not materially affect utility.
  3. [Section 3.1, Algorithm 2 line 3] The MIA attacks implicitly assume that the server can obtain the exact candidate samples (x,y) to be tested and insert them into the public dataset (Algorithm 2, line 3). Section 3.1 only grants the server the ability to select members of the public dataset for knowledge transfer; it never states where the target samples come from or how a realistic server could acquire them. This is a load-bearing assumption: if the server does not have access to the candidate samples, the entire MIA machinery cannot be instantiated. The paper should state this assumption explicitly and discuss its realism relative to existing MIA threat models.
minor comments (6)
  1. [Section 4.2] The word 'evalutate' should be 'evaluate'.
  2. [Abstract and Section 1] The abstract and introduction state that the attacks 'maintain high True Positive Rates under low False Positive Rate constraints,' but Tables 4 and 5 show TPR at 1% FPR below 6% for Fashion-MNIST and Purchase. The claims should be qualified to reflect the datasets and settings where the attack is effective.
  3. [Algorithm 2] The notation in Algorithm 2 is ambiguous when multiple target samples are tested: line 3 writes D_pub ← D_pub ∪ {(x,y)} and line 14 samples from D_pub \ {(x,y)}; it should be made clear whether the set of all inserted candidates is removed from the distillation set, and how members and non-members are treated in the evaluation.
  4. [Section 3.3, Section 5] The threshold β=0.1 for Co-op LiRA reference selection and the distillation sampling fraction (80%) are introduced without a sensitivity analysis; a discussion of how these choices affect attack performance would strengthen the paper.
  5. [Section 4.1.2] The evaluation assumes identical model architectures across clients; the authors should state whether their black-box attacks remain effective under the heterogeneous-architecture setting that motivates FD.
  6. [Table 6] The comparison with baselines is only conducted under FedMD with CIFAR-10 and α=1; the authors should clarify whether the same relative ranking holds in the other frameworks and data distributions.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the LDIA estimator and LiRA variants are measured against independent ground truth, and the public-dataset insertion is an explicit threat-model capability rather than a by-construction prediction.

full rationale

The paper's central derivation chain is self-contained. The LDIA estimator (Eq. 4) averages softmax outputs over a public inference set and is scored against ground-truth private label distributions; no parameter is fitted to those labels, so the reported KL-divergence and Chebyshev values are independent measurements rather than by-construction matches. Co-op LiRA selects reference clients using LDIA, but membership outcomes are known only from the data split, and Distillation-based LiRA trains students on D_pub minus the target sample, with TPR-at-1%-FPR computed against held-out non-members; the reference-model construction does not encode the membership answer. Algorithm 2's insertion of candidate samples into D_pub is an explicit threat-model capability (Section 3.1), and the paper acknowledges (Section 4.3) that FedMD's public pre-training exposes clients to all target samples; this is a realism/confound caveat, not a reduction of the attack's output to its input, since non-member candidates are inserted symmetrically and the LiRA statistic compares the target against reference models rather than thresholding the inserted exposure. No load-bearing self-citations appear; the distillation-based MIA relies on the independent result of Jagielski et al. [14]. The attacks are therefore not circular; their practical strength may depend on the server's public-dataset control, which is a threat-model assumption rather than a circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 1 invented entities

The paper introduces no new parameters beyond the threshold beta, the distillation dataset fraction, and K, which are all labeled as hyperparameters and are not central claims. The attacks rest on the implicit server capability to choose target samples and on the empirical regularity that local models overfit private data. The strongest unstated assumption is the server's ability to insert arbitrary samples into the public dataset, which is granted by the PDA-FD workflow but not quantified in real deployments.

free parameters (5)
  • KL-divergence threshold beta for Co-op LiRA reference selection = 0.1
    Chosen by hand in Algorithm 2 (line 9). No sensitivity analysis is provided, and the performance of Co-op LiRA depends on this threshold.
  • Number of distilled reference models K = 32
    Chosen for all distillation-based LiRA experiments. Section 5.2 shows more reference models help but does not tune K across datasets.
  • Fraction of public dataset sampled for each distilled reference model = 80%
    Chosen randomly (Algorithm 2 line 14) without justification or sensitivity analysis.
  • Number of local update epochs (20 first round, then 5) = Varies by round
    Borrowed from FedMD's recommended setup; directly controls the overfitting level that the attacks exploit. Appendix B shows attack success scales with epochs.
  • DP-SGD clipping bound C = 10
    Fixed for the DP-SGD resilience test; no justification of why this value was chosen.
assumptions (5)
  • domain assumption The server can select and insert target samples into the public dataset used for knowledge transfer.
    Section 3.1 grants the server the right to select public dataset members, and Algorithm 2 line 3 inserts (x, y) into D_pub. The MIA attacks entirely depend on this assumption; without it, the server cannot query the target model on the samples whose membership it wants to infer.
  • domain assumption Clients transmit logits or softmax outputs for public data samples without applying defenses such as clipping, perturbation, or dropout at inference time.
    The attack model describes standard PDA-FD communication phases (Section 2.1). The paper does not analyze detection or obfuscation defenses except DP-SGD.
  • domain assumption The target model's overfitting to its private training data persists during the communication phase and is measurable through logits on the public dataset.
    This is the central assumption underlying both LDIA and MIA. Section 2.2 shows it holds for FedMD on CIFAR-10 when the public and private distributions are similar, but the paper does not provide a general proof or bound. Table 8 and the SVHN row show that when distribution shift is large, the assumption weakens.
  • ad hoc to paper Knowledge-distilled student models trained on the public dataset with target logits behave like reference models: close to the target on non-members, divergent on members.
    Section 3.3.2 justifies this via Figure 6b, showing prediction discrepancies for one CIFAR-10 setting. The student model is used as a reference model for LiRA, but the mechanism is neither formally characterized nor validated across datasets.
  • domain assumption In HFL, clients' private data share the same feature space, so similar label distributions imply similar overall data distributions.
    Stated in Section 3.3.1. This inference is used to select reference models for Co-op LiRA. It fails in cross-silo settings where feature distributions differ across clients.
invented entities (1)
  • No new entities or mediators are introduced.
    purpose: None
    The attacks are built from existing concepts: logits, softmax outputs, LiRA, and knowledge distillation. No new physics, particles, forces, or cryptographic primitives are postulated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Unveiling Client Privacy Leakage from Public Dataset Usage in Federated Distillation." pith.science (2026). https://pith.science/paper/YFCS2BZG

@misc{pith2026250208001,
  author       = {Pith},
  title        = {Pith review of: Unveiling Client Privacy Leakage from Public Dataset Usage in Federated Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YFCS2BZG}},
  note         = {Machine review of arXiv:2502.08001}
}
read the original abstract

Federated Distillation (FD) has emerged as a popular federated training framework, enabling clients to collaboratively train models without sharing private data. Public Dataset-Assisted Federated Distillation (PDA-FD), which leverages public datasets for knowledge sharing, has become widely adopted. Although PDA-FD enhances privacy compared to traditional Federated Learning, we demonstrate that the use of public datasets still poses significant privacy risks to clients' private training data. This paper presents the first comprehensive privacy analysis of PDA-FD in presence of an honest-but-curious server. We show that the server can exploit clients' inference results on public datasets to extract two critical types of private information: label distributions and membership information of the private training dataset. To quantify these vulnerabilities, we introduce two novel attacks specifically designed for the PDA-FD setting: a label distribution inference attack and innovative membership inference methods based on Likelihood Ratio Attack (LiRA). Through extensive evaluation of three representative PDA-FD frameworks (FedMD, DS-FL, and Cronus), our attacks achieve state-of-the-art performance, with label distribution attacks reaching minimal KL-divergence and membership inference attacks maintaining high True Positive Rates under low False Positive Rate constraints. Our findings reveal significant privacy risks in current PDA-FD frameworks and emphasize the need for more robust privacy protection mechanisms in collaborative learning systems.

Figures

Figures reproduced from arXiv: 2502.08001 by the authors.

Figure 1
Figure 1. Workflow of Public Dataset-Assisted Federated Dis [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Visualizing the client’s private model performance [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The mean vector of posterior probability vectors [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Workflow of Label Distribution Inference Attack. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Workflows of two proposed Membership Inference [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Prediction discrepancies between target and refer [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: The LDIA performance of the DS-FL server on the [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Chebyshev distance results of LDIA performed by [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Distillation-based LiRA performance of the DS-FL [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: MIA performance across training rounds. Comparison with Baselines. Our implementations of MIA￾FedDL [23] and GradDiff [39] follow their proposed threat model settings, where the attacker can obtain a shadow dataset of data distribution consistent with the target model…
Figure 11
Figure 11. Figure 11: The performance of distillation-based LiRA vs. [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 22 canonical work pages

  1. [1]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

    2016

  2. [2]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 1897–1914

    2022

  3. [3]

    Hongyan Chang, Virat Shejwalkar, Reza Shokri, and Amir Houmansadr. 2019. Cronus: Robust and heterogeneous collaborative learning with black-box knowl- edge transfer. arXiv preprint arXiv:1912.11279 (2019)

    arXiv 2019

  4. [4]

    Huancheng Chen, Haris Vikalo, et al. 2023. The best of both worlds: Accurate global and personalized models through federated learning with data-free hyper- knowledge distillation. arXiv preprint arXiv:2301.08968 (2023)

    arXiv 2023

  5. [5]

    Zitao Chen and Karthik Pattabiraman. 2023. Overconfidence is a dangerous thing: Mitigating membership inference attacks by enforcing less confident prediction. arXiv preprint arXiv:2307.01610 (2023)

    arXiv 2023

  6. [6]

    Luke N Darlow, Elliot J Crowley, Antreas Antoniou, and Amos J Storkey. 2018. Cinic-10 is not imagenet or cifar-10. arXiv preprint arXiv:1810.03505 (2018)

    arXiv 2018

  7. [7]

    Ilias Diakonikolas, Gautam Kamath, Daniel M Kane, Jerry Li, Ankur Moitra, and Alistair Stewart. 2017. Being robust (in high dimensions) can be practical. In International Conference on Machine Learning . PMLR, 999–1008

    work page 2017

  8. [8]

    DMDave, Todd B, and Will Cukierski. 2014. Acquire Valued Shoppers Challenge. https://kaggle.com/competitions/acquire-valued-shoppers-challenge. Kaggle

    work page 2014

Show all 50 references
  1. [9]

    Yuhao Gu and Yuebin Bai. 2023. LDIA: Label distribution inference attack against federated learning in edge computing. Journal of Information Security and Appli- cations 74 (2023), 103475

    2023

  2. [10]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  3. [11]

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015)

    2015 arXiv

  4. [12]

    Yue Huang, Lanju Kong, Qingzhong Li, and Baochen Zhang. 2023. Decentralized Federated Learning Via Mutual Knowledge Distillation. In2023 IEEE International Conference on Multimedia and Expo (ICME) . IEEE, 342–347

    2023

  5. [13]

    Sohei Itahara, Takayuki Nishio, Yusuke Koda, Masahiro Morikura, and Koji Yamamoto. 2021. Distillation-based semi-supervised federated learning for communication-efficient collaborative training with non-iid private data. IEEE Transactions on Mobile Computing 22, 1 (2021), 191–205

    2021

  6. [14]

    Matthew Jagielski, Milad Nasr, Katherine Lee, Christopher A Choquette-Choo, Nicholas Carlini, and Florian Tramer. 2024. Students parrot their teachers: Mem- bership inference on model distillation.Advances in Neural Information Processing Systems 36 (2024)

    2024

  7. [15]

    Eunjeong Jeong, Seungeun Oh, Hyesung Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. 2018. Communication-efficient on-device machine learning: Federated distillation and augmentation under non-iid private data.arXiv preprint arXiv:1811.11479 (2018)

    2018 arXiv

  8. [16]

    Donglin Jiang, Chen Shan, and Zhihui Zhang. 2020. Federated learning algorithm based on knowledge distillation. In 2020 International conference on artificial intelligence and computer engineering (ICAICE) . IEEE, 163–167

    2020

  9. [17]

    Yangfan Jiang, Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi

  10. [18]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  11. [19]

    Solomon Kullback and Richard A Leibler. 1951. On information and sufficiency. The annals of mathematical statistics 22, 1 (1951), 79–86

    1951

  12. [20]

    Yann Le and Xuan Yang. 2015. Tiny imagenet visual recognition challenge. CS 231N 7, 7 (2015), 3

    2015

  13. [21]

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. 1998. Gradient- based learning applied to document recognition. Proc. IEEE 86, 11 (1998), 2278– 2324

    1998

  14. [22]

    Daliang Li and Junpu Wang. 2019. Fedmd: Heterogenous federated learning via model distillation. arXiv preprint arXiv:1910.03581 (2019)

    2019 arXiv

  15. [23]

    Siqi Liu and Fang Dong. 2023. MIA-FedDL: A Membership Inference Attack against Federated Distillation Learning. In 2023 26th International Conference on Computer Supported Cooperative Work in Design (CSCWD) . IEEE, 1148–1153

    2023

  16. [24]

    Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. 2022. Membership inference attacks by exploiting loss trajectory. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . 2085–2098

    2022

  17. [25]

    Yunhui Long, Lei Wang, Diyue Bu, Vincent Bindschaedler, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. 2020. A pragmatic approach to membership inferences on machine learning models. In 2020 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 521–534

    2020

  18. [26]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial intelligence and statistics . PMLR, 1273–1282

    2017

  19. [27]

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov

  20. [28]

    Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In2019 IEEE symposium on security and privacy (SP). IEEE, 739–753

    2019

  21. [29]

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, An- drew Y Ng, et al. 2011. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning , Vol. 2011. Granada, 4

    2011

  22. [30]

    Andrew Paverd, Andrew Martin, and Ian Brown. 2014. Modelling and automati- cally analysing privacy properties for honest-but-curious adversaries. Tech. Rep (2014)

    2014

  23. [31]

    Raksha Ramakrishna and György Dán. 2022. Inferring Class-Label Distribution in Federated Learning. In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security. 45–56

    2022

  24. [32]

    Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. 2020. {Updates-Leak}: Data set inference and reconstruction attacks in online learning. In 29th USENIX security symposium (USENIX Security 20) . 1291–1308

    2020

  25. [33]

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chieh Chen. 2018. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition . 4510–4520

    2018

  26. [34]

    Virat Shejwalkar and Amir Houmansadr. 2021. Membership privacy for ma- chine learning models through knowledge transfer. In Proceedings of the AAAI conference on artificial intelligence , Vol. 35. 9549–9557

    2021

  27. [35]

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Mem- bership inference attacks against machine learning models. In 2017 IEEE sympo- sium on security and privacy (SP) . IEEE, 3–18

    2017

  28. [36]

    Dianbo Sui, Yubo Chen, Jun Zhao, Yantao Jia, Yuantao Xie, and Weijian Sun

  29. [37]

    Xinyu Tang, Saeed Mahloujifar, Liwei Song, Virat Shejwalkar, Milad Nasr, Amir Houmansadr, and Prateek Mittal. 2022. Mitigating membership inference attacks by{Self-Distillation} through a novel ensemble architecture. In 31st USENIX Security Symposium (USENIX Security 22) . 1433–1450

    2022

  30. [38]

    Aidmar Wainakh, Fabrizio Ventola, Till Müßig, Jens Keim, Carlos Garcia Cordero, Ephraim Zimmer, Tim Grube, Kristian Kersting, and Max Mühlhäuser. 2021. User-level label leakage from gradients in federated learning. arXiv preprint arXiv:2105.09369 (2021)

    2021 arXiv

  31. [39]

    Xiaodong Wang, Longfei Wu, and Zhitao Guan. 2024. GradDiff: Gradient-based membership inference attacks against federated distillation with differential comparison. Information Sciences 658 (2024), 120068

    2024

  32. [40]

    Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. 2021. On the importance of difficulty calibration in membership inference attacks. arXiv preprint arXiv:2111.08440 (2021)

    2021 arXiv

  33. [41]

    Yuxin Wen, Arpit Bansal, Hamid Kazemi, Eitan Borgnia, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2022. Canary in a coalmine: Better membership inference with ensembled adversarial queries. arXiv preprint arXiv:2210.10750 (2022)

    2022 arXiv

  34. [42]

    Chuhan Wu, Fangzhao Wu, Lingjuan Lyu, Yongfeng Huang, and Xing Xie. 2022. Communication-efficient federated learning via knowledge distillation. Nature communications 13, 1 (2022), 2032

    2022

  35. [43]

    H Xiao. 2017. Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747 (2017)

    2017 arXiv

  36. [44]

    Zilu Yang, Yanchao Zhao, and Jiale Zhang. 2022. Fd-leaks: Membership inference attacks against federated distillation learning. In Asia-Pacific Web (APWeb) and Web-Age Information Management (W AIM) Joint International Conference on Web and Big Data. Springer, 364–378

    2022

  37. [45]

    Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. 2022. Enhanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 3093–3106

    2022

  38. [46]

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 268–282. 14 Unveiling Client Privacy Leakage from Public Dat...

    2018

  39. [47]

    Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. 2021. Data-free knowledge distillation for heterogeneous federated learning. In International conference on machine learning. PMLR, 12878–12889. A Additional Experiment Details A.1 Data Splits on Different Datasets The details of the...

    2021

  40. [2019]

    In 2019 IEEE symposium on security and privacy (SP)

    Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE symposium on security and privacy (SP) . IEEE, 691–706

    2019

  41. [2020]

    In Proceedings of the 2020 conference on empirical methods in natural language processing (EMNLP)

    Feded: Federated learning via ensemble distillation for medical relation extraction. In Proceedings of the 2020 conference on empirical methods in natural language processing (EMNLP). 2118–2128

    2020

  42. [2024]

    In 2024 IEEE Symposium on Security and Privacy (SP)

    Protecting Label Distribution in Cross-Silo Federated Learning. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 113–113

    2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.