FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning

Introduction

Federated Learning (FL) is widely recognized for its privacy-preserving capabilities, as it allows multiple clients to collaboratively train a global model without sharing their raw data. However, the exchange of model updates, such as gradients, introduces a significant privacy risk: Membership Inference Attacks (MIAs). These attacks aim to determine whether a specific data point was used to train a client's model. Traditional MIAs in the FL setting often struggle because they lack a reliable "non-member" baseline, frequently requiring computationally expensive "shadow models" that are often impractical for a server-side attacker.

Methodology: The "All for One" Principle

The core innovation of FedMIA is the exploitation of the "All for One" principle. Rather than relying on external auxiliary data, a server-side attacker leverages the updates from all non-target clients to construct a real-time, highly accurate distribution of non-member behavior. This approach eliminates the need for shadow models and provides a tailored baseline for the specific global model being trained.

Expand

Source, p. 4

As illustrated in the figure above, the attack follows a systematic three-step pipeline:

1. Low-dimensional Measurement: High-dimensional gradients are mapped to scalar values using metrics such as Gradient Similarity (comparing an update to the gradient of the target sample) or Loss.
2. Distribution Estimation: The server aggregates measurements from non-target clients to estimate a Gaussian "non-membership" distribution. A 3-sigma filtering rule is applied to ensure the baseline is not contaminated by clients who might coincidentally possess the target data.
3. Membership Inference: A one-tailed hypothesis test (Likelihood-Ratio Test) is performed. If the target client's update is a significant outlier relative to the estimated distribution, it is classified as a member. This process is aggregated over multiple communication rounds to enhance confidence and filter temporal noise.

Experimental Evaluation

The effectiveness of FedMIA was evaluated across three diverse image datasets: CIFAR-100, DermNet (medical skin diseases), and Tiny-ImageNet. The researchers tested various architectures, including ResNet18 and AlexNet for classification tasks, as well as Latent Diffusion Models to assess vulnerability in generative AI.

Key Results and Discussion

FedMIA demonstrates a marked improvement in distinguishing members from non-members compared to existing baselines like Grad-Cosine and Loss-Series.

Expand

Source, p. 1

As shown in the comparison above, traditional MIAs exhibit significant overlap between member and non-member distributions (with mean differences as low as 0.027). In contrast, FedMIA achieves much wider separation (mean differences of 0.167 to 0.233), leading to significantly higher True Positive Rates (TPR). For instance, on AlexNet trained on CIFAR-100, FedMIA achieved a TPR of approximately 67% at a 0.1% False Positive Rate, substantially outperforming the next best existing method (~54%).

Robustness and Generalization

• Defense Resistance: FedMIA remains effective against common defenses like Differential Privacy (Gradient Perturbation) and MixUp, maintaining a superior privacy-utility trade-off compared to its competitors.
• Data Heterogeneity: Interestingly, the attack's performance improves in Non-IID (heterogeneous) settings, where member samples stand out more distinctly against the varied background of other clients.
• Generative Models: The attack successfully identifies training samples in Diffusion models, highlighting that generative architectures are equally susceptible to cross-client information exploitation.

Conclusion

FedMIA exposes a fundamental vulnerability in the standard FL protocol: the server's ability to use the collective updates of the "many" to compromise the privacy of the "one." While lightweight defenses like gradient sparsification offer some protection, they are insufficient against this "All for One" strategy. The primary technical barrier to FedMIA is Secure Aggregation, which prevents the server from inspecting individual client updates. Future research must focus on developing robust defenses that can mitigate these cross-client information leaks without the heavy overhead of full cryptographic protocols.

@inproceedings{zhu2025fedmia,
  author = {Gongxi Zhu and Donghao Li and Hanlin Gu and Yuan Yao and Lixin Fan and Yuxing Han},
  title = {{FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  year = {2025},
  doi = {10.1109/cvpr52734.2025.01922},
}