{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T01:19:24Z","timestamp":1792891164274,"version":"4.5.0"},"reference-count":173,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2024,12,10]],"date-time":"2024-12-10T00:00:00Z","timestamp":1733788800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62072390, 92270123, and 62102334"],"award-info":[{"award-number":["62072390, 92270123, and 62102334"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100002920","name":"Research Grants Council, University Grants Committee","doi-asserted-by":"crossref","award":["15222118, 15218919, 15203120, 15226221, 15225921, 15209922, and C2004-21GF"],"award-info":[{"award-number":["15222118, 15218919, 15203120, 15226221, 15225921, 15209922, and C2004-21GF"]}],"id":[{"id":"10.13039\/501100002920","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2025,4,30]]},"abstract":"<jats:p>Federated learning is a decentralized machine learning approach where clients train models locally and share model updates to develop a global model. This enables low-resource devices to collaboratively build a high-quality model without requiring direct access to the raw training data. However, despite only sharing model updates, federated learning still faces several privacy vulnerabilities. One of the key threats is membership inference attacks, which target clients\u2019 privacy by determining whether a specific example is part of the training set. These attacks can compromise sensitive information in real-world applications, such as medical diagnoses within a healthcare system. Although there has been extensive research on membership inference attacks, a comprehensive and up-to-date survey specifically focused on it within federated learning is still absent. To fill this gap, we categorize and summarize membership inference attacks and their corresponding defense strategies based on their characteristics in this setting. We introduce a unique taxonomy of existing attack research and provide a systematic overview of various countermeasures. For these studies, we thoroughly analyze the strengths and weaknesses of different approaches. Finally, we identify and discuss key future research directions for readers interested in advancing the field.<\/jats:p>\n                  <jats:p\/>","DOI":"10.1145\/3704633","type":"journal-article","created":{"date-parts":[[2024,11,14]],"date-time":"2024-11-14T06:00:06Z","timestamp":1731564006000},"page":"1-35","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":152,"title":["Membership Inference Attacks and Defenses in Federated Learning: A Survey"],"prefix":"10.1145","volume":"57","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7202-3178","authenticated-orcid":false,"given":"Li","family":"Bai","sequence":"first","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9008-2112","authenticated-orcid":false,"given":"Haibo","family":"Hu","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1547-2847","authenticated-orcid":false,"given":"Qingqing","family":"Ye","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8235-6753","authenticated-orcid":false,"given":"Haoyang","family":"Li","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3475-9552","authenticated-orcid":false,"given":"Leixia","family":"Wang","sequence":"additional","affiliation":[{"name":"Renmin University of China, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9404-5848","authenticated-orcid":false,"given":"Jianliang","family":"Xu","sequence":"additional","affiliation":[{"name":"Hong Kong Baptist University, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,10]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/954339.954342"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_1_7_2","first-page":"4171","volume-title":"Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT\u201919)","author":"Kenton Jacob Devlin, Ming-Wei Chang,","year":"2019","unstructured":"Jacob Devlin, Ming-Wei Chang, KentonLee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT\u201919). 4171\u20134186."},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.psychres.2021.114135"},{"key":"e_1_3_1_9_2","article-title":"Efficient estimation of word representations in vector space","author":"Mikolov Tomas","year":"2013","unstructured":"Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013. Efficient estimation of word representations in vector space. In International Conference on Learning Representations (ICLR\u201913), Workshop Track Proceedings.","journal-title":"International Conference on Learning Representations (ICLR\u201913)"},{"key":"e_1_3_1_10_2","unstructured":"Ilya Sutskever Oriol Vinyals and Quoc V Le. 2014. Sequence to sequence learning with neural networks. In Proceeding of Advances in Neural Information Processing System (NeurIPS\u201914). 3104\u20133112."},{"key":"e_1_3_1_11_2","unstructured":"GDPR. 2019. General Data Protection Regulation. https:\/\/gdpr-info.eu\/."},{"key":"e_1_3_1_12_2","unstructured":"CCPA. 2018. California Consumer Privacy Act. https:\/\/leginfo.legislature.ca.gov\/."},{"key":"e_1_3_1_13_2","first-page":"1273","volume-title":"Artificial Intelligence and Statistics","author":"McMahan Brendan","year":"2017","unstructured":"Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics. PMLR, 1273\u20131282."},{"key":"e_1_3_1_14_2","article-title":"idlg: Improved deep leakage from gradients","author":"Zhao Bo","year":"2020","unstructured":"Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610 (2020).","journal-title":"arXiv preprint arXiv:2001.02610"},{"key":"e_1_3_1_15_2","unstructured":"Ligeng Zhu Zhijian Liu and Song Han. 2019. Deep leakage from gradients. Advances in Neural Information Processing Systems (NeurIPS\u201919). 14747\u201314756."},{"key":"e_1_3_1_16_2","article-title":"Reconstruction of training samples from loss functions","author":"Sannai Akiyoshi","year":"2018","unstructured":"Akiyoshi Sannai. 2018. Reconstruction of training samples from loss functions. arXiv preprint arXiv:1805.07337 (2018).","journal-title":"arXiv preprint arXiv:1805.07337"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3028110"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737416"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pgen.1000167"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23183"},{"key":"e_1_3_1_25_2","article-title":"Membership inference attacks against deep learning models via logits distribution","author":"Yan Hongyang","year":"2022","unstructured":"Hongyang Yan, Shuhao Li, Yajie Wang, Yaoyuan Zhang, Kashif Sharif, Haibo Hu, and Yuanzhang Li. 2022. Membership inference attacks against deep learning models via logits distribution. IEEE Transactions on Dependable and Secure Computing 20, 5 (2022), 3799\u20133808.","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_3_1_26_2","first-page":"10203","article-title":"MExMI: Pool-based active model extraction crossover membership inference","volume":"35","author":"Xiao Yaxin","year":"2022","unstructured":"Yaxin Xiao, Qingqing Ye, Haibo Hu, Huadi Zheng, Chengfang Fang, and Jie Shi. 2022. MExMI: Pool-based active model extraction crossover membership inference. Advances in Neural Information Processing Systems (NeurIPS\u201922) 35 (2022), 10203\u201310216.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS\u201922)"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICC40277.2020.9148790"},{"key":"e_1_3_1_29_2","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS\u201920)","year":"2020","unstructured":"Anastasia Pustozerova and Rudolf Mayer. 2020. Information leaks in federated learning. In Proceedings of the Network and Distributed System Security Symposium (NDSS\u201920) 10 (2020), 122."},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM51629.2021.00129"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2022.103201"},{"key":"e_1_3_1_32_2","first-page":"228","volume-title":"Medical Imaging with Deep Learning","author":"Gupta Umang","year":"2021","unstructured":"Umang Gupta, Dimitris Stripelis, Pradeep K. Lam, Paul Thompson, Jos\u00e9 Luis Ambite, and Greg Ver Steeg. 2021. Membership inference attacks on deep regression models for neuroimaging. In Medical Imaging with Deep Learning. PMLR, 228\u2013251."},{"key":"e_1_3_1_33_2","article-title":"Membership inference defense in distributed federated learning based on gradient differential privacy and trust domain division mechanisms","volume":"2022","author":"Liu Zhenpeng","year":"2022","unstructured":"Zhenpeng Liu, Ruilin Li, Dewei Miao, Lele Ren, and Yonggang Zhao. 2022. Membership inference defense in distributed federated learning based on gradient differential privacy and trust domain division mechanisms. Security and Communication Networks 2022 (2022), 1615476.","journal-title":"Security and Communication Networks"},{"key":"e_1_3_1_34_2","volume-title":"11th International Conference on Learning Representations (ICLR\u201923)","author":"Li Jiacheng","year":"2023","unstructured":"Jiacheng Li, Ninghui Li, and Bruno Ribeiro. 2023. Effective passive membership inference attacks in federated learning against overparameterized models. In 11th International Conference on Learning Representations (ICLR\u201923)."},{"key":"e_1_3_1_35_2","article-title":"Perfectly accurate membership inference by a dishonest central server in federated learning","author":"Pichler Georg","year":"2022","unstructured":"Georg Pichler, Marco Romanelli, Leonardo Rey Vega, and Pablo Piantanida. 2022. Perfectly accurate membership inference by a dishonest central server in federated learning. arXiv preprint arXiv:2203.16463 (2022).","journal-title":"arXiv preprint arXiv:2203.16463"},{"key":"e_1_3_1_36_2","unstructured":"Oualid Zari Chuan Xu and Giovanni Neglia. 2021. Efficient passive membership inference attack in federated learning. In Neural Information Processing Systems-workshop Privacy in Machine Learning."},{"key":"e_1_3_1_37_2","article-title":"Subject membership inference attacks in federated learning","author":"Suri Anshuman","year":"2022","unstructured":"Anshuman Suri, Pallika Kanani, Virendra J. Marathe, and Daniel W. Peterson. 2022. Subject membership inference attacks in federated learning. arXiv preprint arXiv:2206.03317 (2022).","journal-title":"arXiv preprint arXiv:2206.03317"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3160699"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/NCA51143.2020.9306745"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447867"},{"key":"e_1_3_1_41_2","article-title":"Defenses to membership inference attacks: A survey","author":"Hu Li","year":"2023","unstructured":"Li Hu, Anli Yan, Hongyang Yan, Jin Li, Teng Huang, Yingying Zhang, Changyu Dong, and Chunsheng Yang. 2023. Defenses to membership inference attacks: A survey. Computing Surveys 56, 4 (2023), 92:1\u201392:34.","journal-title":"Computing Surveys"},{"key":"e_1_3_1_42_2","volume-title":"International Conference on Learning Representations (ICLR\u201918),","author":"McMahan H. Brendan","year":"2018","unstructured":"H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. 2018. Learning differentially private recurrent language models. In International Conference on Learning Representations (ICLR\u201918), Conference Track Proceedings."},{"key":"e_1_3_1_43_2","article-title":"Differentially private federated learning: A client level perspective","author":"Geyer Robin C.","year":"2017","unstructured":"Robin C. Geyer, Tassilo Klein, and Moin Nabi. 2017. Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557 (2017).","journal-title":"arXiv preprint arXiv:1712.07557"},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23119"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01455"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484575"},{"key":"e_1_3_1_47_2","first-page":"1964","volume-title":"International Conference on Machine Learning (ICML\u201921)","author":"Choquette-Choo Christopher A.","year":"2021","unstructured":"Christopher A. Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. 2021. Label-only membership inference attacks. In International Conference on Machine Learning (ICML\u201921). PMLR, 1964\u20131974."},{"key":"e_1_3_1_48_2","first-page":"1605","volume-title":"29th USENIX Security Symposium (USENIX Security\u201920)","author":"Leino Klas","year":"2020","unstructured":"Klas Leino and Matt Fredrikson. 2020. Stolen memories: Leveraging model memorization for calibrated white-box membership inference. In 29th USENIX Security Symposium (USENIX Security\u201920). 1605\u20131622."},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560554"},{"key":"e_1_3_1_50_2","volume-title":"Advances in Neural Information Processing Systems (NeurIPS\u201922)","author":"Chen Yufei","year":"2022","unstructured":"Yufei Chen, Chao Shen, Yun Shen, Cong Wang, and Yang Zhang. 2022. Amplifying membership exposure via data poisoning. In Advances in Neural Information Processing Systems (NeurIPS\u201922)."},{"key":"e_1_3_1_51_2","article-title":"A survey on federated learning systems: Vision, hype and reality for data privacy and protection","author":"Li Qinbin","year":"2021","unstructured":"Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. 2021. A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Transactions on Knowledge and Data Engineering 35, 4 (2021), 3347\u20133366.","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1561\/2200000083"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"e_1_3_1_54_2","article-title":"Privacy and robustness in federated learning: Attacks and defenses","author":"Lyu Lingjuan","year":"2022","unstructured":"Lingjuan Lyu, Han Yu, Xingjun Ma, Chen Chen, Lichao Sun, Jun Zhao, Qiang Yang, and S. Yu Philip. 2022. Privacy and robustness in federated learning: Attacks and defenses. IEEE Transactions on Neural Networks and Learning Systems 35, 7 (2022), 8726\u20138746.","journal-title":"IEEE Transactions on Neural Networks and Learning Systems"},{"key":"e_1_3_1_55_2","article-title":"Threats to federated learning: A survey","volume":"2003","author":"Lyu Lingjuan","year":"2020","unstructured":"Lingjuan Lyu, Han Yu, and Qiang Yang. 2020. Threats to federated learning: A survey. ArXiv abs\/2003.02133 (2020).","journal-title":"ArXiv"},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/NaNA53684.2021.00062"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3075203"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2020.3039941"},{"key":"e_1_3_1_59_2","doi-asserted-by":"crossref","unstructured":"Huiqiang Chen Tianqing Zhu Tao Zhang Wanlei Zhou and Philip S. Yu. 2023. Privacy and fairness in federated learning: On the perspective of trade-off. ACM Computing Surveys 56 2 (2023) 1\u201337.","DOI":"10.1145\/3606017"},{"key":"e_1_3_1_60_2","article-title":"Evaluating membership inference attacks and defenses in federated learning","author":"Zhu Gongxi","year":"2024","unstructured":"Gongxi Zhu, Donghao Li, Hanlin Gu, Yuxing Han, Yuan Yao, Lixin Fan, and Qiang Yang. 2024. Evaluating membership inference attacks and defenses in federated learning. arXiv preprint arXiv:2402.06289 (2024).","journal-title":"arXiv preprint arXiv:2402.06289"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102378"},{"key":"e_1_3_1_62_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN49398.2020.9209744"},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813687"},{"key":"e_1_3_1_64_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1045"},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","DOI":"10.5555\/1382436.1382751"},{"key":"e_1_3_1_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512233"},{"key":"e_1_3_1_67_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23054"},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3590334"},{"key":"e_1_3_1_69_2","article-title":"Principles of risk minimization for learning theory","volume":"4","author":"Vapnik Vladimir","year":"1991","unstructured":"Vladimir Vapnik. 1991. Principles of risk minimization for learning theory. Advances in Neural Information Processing Systems (NeurIPS\u201991) 4 (1991), 831\u2013838.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS\u201991)"},{"issue":"3","key":"e_1_3_1_70_2","first-page":"6","article-title":"Online algorithms and stochastic approximations","volume":"5","author":"Saad David","year":"1998","unstructured":"David Saad. 1998. Online algorithms and stochastic approximations. Online Learning 5, 3 (1998), 6.","journal-title":"Online Learning"},{"issue":"7","key":"e_1_3_1_71_2","article-title":"Adaptive subgradient methods for online learning and stochastic optimization.","volume":"12","author":"Duchi John","year":"2011","unstructured":"John Duchi, Elad Hazan, and Yoram Singer. 2011. Adaptive subgradient methods for online learning and stochastic optimization. Journal of Machine Learning Research 12, 7 (2011), 2121\u20132159.","journal-title":"Journal of Machine Learning Research"},{"key":"e_1_3_1_72_2","volume-title":"3rd International Conference on Learning Representations (ICLR\u201915), Conference Track Proceedings","author":"Kingma Diederik P.","year":"2015","unstructured":"Diederik P. Kingma and Jimmy Ba. 2015. Adam: A method for stochastic optimization. In 3rd International Conference on Learning Representations (ICLR\u201915), Conference Track Proceedings."},{"key":"e_1_3_1_73_2","doi-asserted-by":"publisher","DOI":"10.1007\/s41666-020-00082-4"},{"key":"e_1_3_1_74_2","doi-asserted-by":"publisher","DOI":"10.1145\/3501296"},{"key":"e_1_3_1_75_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2021.3090430"},{"key":"e_1_3_1_76_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2021.3075439"},{"key":"e_1_3_1_77_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16960"},{"key":"e_1_3_1_78_2","first-page":"19478","article-title":"Throughput-optimal topology design for cross-silo federated learning","volume":"33","author":"Marfoq Othmane","year":"2020","unstructured":"Othmane Marfoq, Chuan Xu, Giovanni Neglia, and Richard Vidal. 2020. Throughput-optimal topology design for cross-silo federated learning. Advances in Neural Information Processing Systems (NeurIPS\u201920) 33 (2020), 19478\u201319487.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS\u201920)"},{"key":"e_1_3_1_79_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5895"},{"key":"e_1_3_1_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.2988525"},{"key":"e_1_3_1_81_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9005992"},{"key":"e_1_3_1_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9006280"},{"key":"e_1_3_1_83_2","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357370"},{"key":"e_1_3_1_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2019.00056"},{"key":"e_1_3_1_85_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484749"},{"key":"e_1_3_1_86_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_1_87_2","volume-title":"USENIX Security Symposium (USENIX Security\u201921)","author":"Song Liwei","year":"2021","unstructured":"Liwei Song and Prateek Mittal. 2021. Systematic evaluation of privacy risks of machine learning models. In USENIX Security Symposium (USENIX Security\u201921). 2615\u20132632."},{"key":"e_1_3_1_88_2","volume-title":"International Conference on Learning Representations (ICLR\u201922)","author":"Watson Lauren","year":"2022","unstructured":"Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. 2022. On the importance of difficulty calibration in membership inference attacks. In International Conference on Learning Representations (ICLR\u201922)."},{"key":"e_1_3_1_89_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"e_1_3_1_90_2","first-page":"5558","volume-title":"International Conference on Machine Learning (ICML\u201919)","author":"Sablayrolles Alexandre","year":"2019","unstructured":"Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Herv\u00e9 J\u00e9gou. 2019. White-box vs black-box: Bayes optimal strategies for membership inference. In International Conference on Machine Learning (ICML\u201919). PMLR, 5558\u20135567."},{"key":"e_1_3_1_91_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.082"},{"key":"e_1_3_1_92_2","first-page":"1895","volume-title":"28th USENIX Security Symposium (USENIX Security\u201919)","author":"Jayaraman Bargav","year":"2019","unstructured":"Bargav Jayaraman and David Evans. 2019. Evaluating differentially private machine learning in practice. In 28th USENIX Security Symposium (USENIX Security\u201919). 1895\u20131912."},{"key":"e_1_3_1_93_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363201"},{"key":"e_1_3_1_94_2","article-title":"User-level membership inference for federated learning in wireless network environment","author":"Zhao Yanchao","year":"2021","unstructured":"Yanchao Zhao, Jiale Chen, Jiale Zhang, Zilu Yang, Huawei Tu, Hao Han, Kun Zhu, and Bing Chen. 2021. User-level membership inference for federated learning in wireless network environment. Wireless Communications and Mobile Computing 2021.1 (2021), 5534270.","journal-title":"Wireless Communications and Mobile Computing"},{"key":"e_1_3_1_95_2","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2020.3000373"},{"key":"e_1_3_1_96_2","doi-asserted-by":"publisher","DOI":"10.1145\/3591197.3593638"},{"key":"e_1_3_1_97_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICNC59896.2024.10556313"},{"key":"e_1_3_1_98_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2019.2897554"},{"key":"e_1_3_1_99_2","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583359"},{"key":"e_1_3_1_100_2","first-page":"5714","volume-title":"International Conference on Artificial Intelligence and Statistics (AISTATS\u201923)","volume":"206","author":"Nguyen Truc","year":"2023","unstructured":"Truc Nguyen, Phung Lai, Khang Tran, NhatHai Phan, and My T. Thai. 2023. Active membership inference attack under local differential privacy in federated learning. In International Conference on Artificial Intelligence and Statistics (AISTATS\u201923), Vol. 206. PMLR, 5714\u20135730."},{"key":"e_1_3_1_101_2","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583542"},{"key":"e_1_3_1_102_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3303718"},{"key":"e_1_3_1_103_2","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607204"},{"key":"e_1_3_1_104_2","article-title":"Scalable training of mixture models via coresets","volume":"24","author":"Feldman Dan","year":"2011","unstructured":"Dan Feldman, Matthew Faulkner, and Andreas Krause. 2011. Scalable training of mixture models via coresets. Advances in Neural Information Processing Systems (NeurIPS\u201911) 24 (2011), 2142\u20132150.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS\u201911)"},{"key":"e_1_3_1_105_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_1_106_2","volume-title":"International Conference on Learning Representations (ICLR\u201919)","author":"Bernstein Jeremy","year":"2019","unstructured":"Jeremy Bernstein, Jiawei Zhao, Kamyar Azizzadenesheli, and Anima Anandkumar. 2019. signSGD with majority vote is communication efficient and fault tolerant. In International Conference on Learning Representations (ICLR\u201919)."},{"key":"e_1_3_1_107_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-25201-3_28"},{"key":"e_1_3_1_108_2","doi-asserted-by":"publisher","DOI":"10.5555\/648054.743935"},{"key":"e_1_3_1_109_2","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052569"},{"key":"e_1_3_1_110_2","doi-asserted-by":"publisher","DOI":"10.1145\/3397271.3401063"},{"key":"e_1_3_1_111_2","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0031"},{"key":"e_1_3_1_112_2","article-title":"Subject granular differential privacy in federated learning","author":"Marathe Virendra J.","year":"2022","unstructured":"Virendra J. Marathe and Pallika Kanani. 2022. Subject granular differential privacy in federated learning. arXiv preprint arXiv:2206.03617 (2022).","journal-title":"arXiv preprint arXiv:2206.03617"},{"key":"e_1_3_1_113_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354211"},{"key":"e_1_3_1_114_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560684"},{"key":"e_1_3_1_115_2","article-title":"Sparsified SGD with memory","volume":"31","author":"Stich Sebastian U.","year":"2018","unstructured":"Sebastian U. Stich, Jean-Baptiste Cordonnier, and Martin Jaggi. 2018. Sparsified SGD with memory. Advances in Neural Information Processing Systems (NeurIPS\u201918) 31 (2018), 4452\u20134463.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS\u201918)"},{"key":"e_1_3_1_116_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5793"},{"key":"e_1_3_1_117_2","volume-title":"6th International Conference on Learning Representations (ICLR\u201918), Conference Track Proceedings","author":"Lin Yujun","year":"2018","unstructured":"Yujun Lin, Song Han, Huizi Mao, Yu Wang, and William J. Dally. 2018. Deep gradient compression: Reducing the communication bandwidth for distributed training. In 6th International Conference on Learning Representations (ICLR\u201918), Conference Track Proceedings."},{"key":"e_1_3_1_118_2","volume-title":"International Conference on Learning Representations (ICLR\u201919)","author":"Dai Wei","year":"2019","unstructured":"Wei Dai, Yi Zhou, Nanqing Dong, Hao Zhang, and Eric Xing. 2019. Toward understanding the impact of staleness in distributed machine learning. In International Conference on Learning Representations (ICLR\u201919)."},{"key":"e_1_3_1_119_2","volume-title":"6th International Conference on Learning Representations (ICLR\u201918)","author":"Tsuzuku Yusuke","year":"2018","unstructured":"Yusuke Tsuzuku, Hiroto Imachi, and Takuya Akiba. 2018. Variance-based gradient compression for efficient distributed deep learning. In 6th International Conference on Learning Representations (ICLR\u201918)."},{"key":"e_1_3_1_120_2","first-page":"1397","volume-title":"31st USENIX Security Symposium (USENIX Security\u201922)","author":"Fu Chong","year":"2022","unstructured":"Chong Fu, Xuhong Zhang, Shouling Ji, Jinyin Chen, Jingzheng Wu, Shanqing Guo, Jun Zhou, Alex X. Liu, and Ting Wang. 2022. Label inference attacks against vertical federated learning. In 31st USENIX Security Symposium (USENIX Security\u201922). 1397\u20131414."},{"key":"e_1_3_1_121_2","article-title":"Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer","author":"Chang Hongyan","year":"2019","unstructured":"Hongyan Chang, Virat Shejwalkar, Reza Shokri, and Amir Houmansadr. 2019. Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer. arXiv preprint arXiv:1912.11279 (2019).","journal-title":"arXiv preprint arXiv:1912.11279"},{"key":"e_1_3_1_122_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-18523-6_14"},{"key":"e_1_3_1_123_2","first-page":"4561","volume-title":"31st USENIX Security Symposium (USENIX Security\u201922)","author":"Yuan Xiaoyong","year":"2022","unstructured":"Xiaoyong Yuan and Lan Zhang. 2022. Membership inference attacks and defenses in neural network pruning. In 31st USENIX Security Symposium (USENIX Security\u201922). 4561\u20134578."},{"key":"e_1_3_1_124_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2787987"},{"key":"e_1_3_1_125_2","doi-asserted-by":"publisher","DOI":"10.3934\/mfc.2018015"},{"key":"e_1_3_1_126_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460427"},{"key":"e_1_3_1_127_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"e_1_3_1_128_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"e_1_3_1_129_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICIRCA48905.2020.9183133"},{"key":"e_1_3_1_130_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW53761.2021.00017"},{"key":"e_1_3_1_131_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-70365-2_11"},{"key":"e_1_3_1_132_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3128679"},{"key":"e_1_3_1_133_2","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_14"},{"issue":"11","key":"e_1_3_1_134_2","first-page":"169","article-title":"On data banks and privacy homomorphisms","volume":"4","author":"Rivest Ronald L.","year":"1978","unstructured":"Ronald L. Rivest, Len Adleman, and Michael L. Dertouzos. 1978. On data banks and privacy homomorphisms. Foundations of Secure Computation 4, 11 (1978), 169\u2013180.","journal-title":"Foundations of Secure Computation"},{"key":"e_1_3_1_135_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCS52626.2021.9449214"},{"key":"e_1_3_1_136_2","volume-title":"Proceedings of the 2020 USENIX Annual Technical Conference (USENIX ATC\u201920)","author":"Zhang Chengliang","year":"2020","unstructured":"Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. 2020. Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning. In Proceedings of the 2020 USENIX Annual Technical Conference (USENIX ATC\u201920). 493\u2013506."},{"key":"e_1_3_1_137_2","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM48099.2022.10001614"},{"key":"e_1_3_1_138_2","article-title":"Vertical federated learning","author":"Liu Yang","year":"2022","unstructured":"Yang Liu, Yan Kang, Tianyuan Zou, Yanhong Pu, Yuanqin He, Xiaozhou Ye, Ye Ouyang, Ya-Qin Zhang, and Qiang Yang. 2022. Vertical federated learning. arXiv preprint arXiv:2211.12814 (2022).","journal-title":"arXiv preprint arXiv:2211.12814"},{"key":"e_1_3_1_139_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2021.106775"},{"key":"e_1_3_1_140_2","doi-asserted-by":"publisher","DOI":"10.5555\/1791834.1791836"},{"key":"e_1_3_1_141_2","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.3010335"},{"key":"e_1_3_1_142_2","article-title":"That which we call private","author":"Erlingsson Ulfar","year":"2019","unstructured":"Ulfar Erlingsson, Ilya Mironov, Ananth Raghunathan, and Shuang Song. 2019. That which we call private. arXiv preprint arXiv:1908.03566 (2019).","journal-title":"arXiv preprint arXiv:1908.03566"},{"key":"e_1_3_1_143_2","doi-asserted-by":"publisher","DOI":"10.14778\/3484224.3484231"},{"key":"e_1_3_1_144_2","doi-asserted-by":"publisher","DOI":"10.5555\/2567709.2502603"},{"key":"e_1_3_1_145_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF57540.2023.00013"},{"key":"e_1_3_1_146_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00069"},{"key":"e_1_3_1_147_2","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394533"},{"issue":"1","key":"e_1_3_1_148_2","first-page":"61","article-title":"Membership inference attack against differentially private deep learning model","volume":"11","author":"Rahman Md Atiqur","year":"2018","unstructured":"Md Atiqur Rahman, Tanzila Rahman, Robert Lagani\u00e8re, Noman Mohammed, and Yang Wang. 2018. Membership inference attack against differentially private deep learning model. Transactions on Data Privacy 11, 1 (2018), 61\u201379.","journal-title":"Transactions on Data Privacy"},{"key":"e_1_3_1_149_2","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.2019.1700130"},{"key":"e_1_3_1_150_2","first-page":"12589","volume-title":"International Conference on Machine Learning (ICML\u201921)","author":"Zhang Mengjiao","year":"2021","unstructured":"Mengjiao Zhang and Shusen Wang. 2021. Matrix sketching for secure collaborative machine learning. In International Conference on Machine Learning (ICML\u201921). PMLR, 12589\u201312599."},{"key":"e_1_3_1_151_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSN53354.2021.00036"},{"key":"e_1_3_1_152_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58367.2023.00037"},{"key":"e_1_3_1_153_2","article-title":"Machine learning with adversaries: Byzantine tolerant gradient descent","volume":"30","author":"Blanchard Peva","year":"2017","unstructured":"Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems (NeurIPS\u201917) 30 (2017), 119\u2013129.","journal-title":"Advances in Neural Information Processing Systems (NeurIPS\u201917)"},{"key":"e_1_3_1_154_2","first-page":"5650","volume-title":"International Conference on Machine Learning (ICML\u201918)","author":"Yin Dong","year":"2018","unstructured":"Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning (ICML\u201918). PMLR, 5650\u20135659."},{"key":"e_1_3_1_155_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24434"},{"issue":"7","key":"e_1_3_1_156_2","article-title":"Membership inference attacks and defenses in supervised learning via generalization gap","volume":"3","author":"Li Jiacheng","year":"2020","unstructured":"Jiacheng Li, Ninghui Li, and Bruno Ribeiro. 2020. Membership inference attacks and defenses in supervised learning via generalization gap. arXiv preprint arXiv:2002.12062 3, 7 (2020).","journal-title":"arXiv preprint arXiv:2002.12062"},{"key":"e_1_3_1_157_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_3"},{"key":"e_1_3_1_158_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00780"},{"key":"e_1_3_1_159_2","article-title":"Federated learning for mobile keyboard prediction","author":"Hard Andrew","year":"2018","unstructured":"Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Fran\u00e7oise Beaufays, Sean Augenstein, Hubert Eichner, Chlo\u00e9 Kiddon, and Daniel Ramage. 2018. Federated learning for mobile keyboard prediction. arXiv preprint arXiv:1811.03604 (2018).","journal-title":"arXiv preprint arXiv:1811.03604"},{"key":"e_1_3_1_160_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2018.8486352"},{"key":"e_1_3_1_161_2","article-title":"Blockchain-based federated learning in mobile edge networks with application in internet of vehicles","author":"Wang Rui","year":"2021","unstructured":"Rui Wang, Heju Li, and Erwu Liu. 2021. Blockchain-based federated learning in mobile edge networks with application in internet of vehicles. arXiv preprint arXiv:2103.01116 (2021).","journal-title":"arXiv preprint arXiv:2103.01116"},{"key":"e_1_3_1_162_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3017377"},{"key":"e_1_3_1_163_2","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403298"},{"key":"e_1_3_1_164_2","first-page":"634","volume-title":"International Conference on Machine Learning (ICML\u201919)","author":"Bhagoji Arjun Nitin","year":"2019","unstructured":"Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. 2019. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning (ICML\u201919). PMLR, 634\u2013643."},{"key":"e_1_3_1_165_2","doi-asserted-by":"publisher","DOI":"10.5555\/3489212.3489304"},{"key":"e_1_3_1_166_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICPADS47876.2019.00042"},{"key":"e_1_3_1_167_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-5562-2_14"},{"key":"e_1_3_1_168_2","first-page":"2938","volume-title":"International Conference on Artificial Intelligence and Statistics (AISTATS\u201920)","author":"Bagdasaryan Eugene","year":"2020","unstructured":"Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics (AISTATS\u201920). PMLR, 2938\u20132948."},{"key":"e_1_3_1_169_2","volume-title":"International Conference on Learning Representations (ICLR\u201920)","author":"Xie Chulin","year":"2020","unstructured":"Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2020. DBA: Distributed backdoor attacks against federated learning. In International Conference on Learning Representations (ICLR\u201920)."},{"key":"e_1_3_1_170_2","unstructured":"Chien-Lun Chen Leana Golubchik and Marco Paolieri. 2020. Backdoor attacks on federated meta-learning. CoRR abs\/2006.07026 (2020). Retrieved from https:\/\/arxiv.org\/abs\/2006.07026"},{"key":"e_1_3_1_171_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179401"},{"key":"e_1_3_1_172_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.02.025"},{"key":"e_1_3_1_173_2","first-page":"601","volume-title":"USENIX Security Symposium (USENIX Security\u201916)","author":"Tram\u00e8r Florian","year":"2016","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction APIs. In USENIX Security Symposium (USENIX Security\u201916), Vol. 16. 601\u2013618."},{"key":"e_1_3_1_174_2","first-page":"4525","volume-title":"31st USENIX Security Symposium (USENIX Security\u201922)","author":"Liu Yugeng","year":"2022","unstructured":"Yugeng Liu, Rui Wen, Xinlei He, Ahmed Salem, Zhikun Zhang, Michael Backes, Emiliano De Cristofaro, Mario Fritz, and Yang Zhang. 2022. ML-Doctor: Holistic risk assessment of inference attacks against machine learning models. In 31st USENIX Security Symposium (USENIX Security\u201922). 4525\u20134542."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3704633","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3704633","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T21:17:58Z","timestamp":1750281478000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3704633"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,10]]},"references-count":173,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,4,30]]}},"alternative-id":["10.1145\/3704633"],"URL":"https:\/\/doi.org\/10.1145\/3704633","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,12,10]]},"assertion":[{"value":"2023-10-10","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-11-11","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-12-10","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}