Subject Membership Inference Attacks in Federated Learning
Privacy in Federated Learning (FL) is studied at two different granularities:
item-level, which protects individual data points, and user-level, which
protects each user (participant) in the federation. Nearly all of the private
FL literature is dedicated to studying privacy attacks and defenses at these
two granularities. Recently, subject-level privacy has emerged as an
alternative privacy granularity to protect the privacy of individuals (data
subjects) whose data is spread across multiple (organizational) users in
cross-silo FL settings. An adversary might be interested in recovering private
information about these individuals (a.k.a. \emph{data subjects}) by attacking
the trained model. A systematic study of these patterns requires complete
control over the federation, which is impossible with real-world datasets. We
design a simulator for generating various synthetic federation configurations,
enabling us to study how properties of the data, model design and training, and
the federation itself impact subject privacy risk. We propose three attacks for
\emph{subject membership inference} and examine the interplay between all
factors within a federation that affect the attacks' efficacy. We also
investigate the effectiveness of Differential Privacy in mitigating this
threat. Our takeaways generalize to real-world datasets like FEMNIST, giving
credence to our findings.