Label-Only Membership Inference Attack Against Federated Distillation

Federated learning is a prevailing distributed machine learning paradigm that aims to protect data privacy by training models locally. However, it is still vulnerable to various attacks, such as federated membership inference attacks, which can reveal the data or model information of the participants. To prevent these attacks, some protection measures have been proposed, such as data encryption/distortion or federated distillation (FD). It is a more sophisticated framework that communicates logits instead of model parameters, which can enhance the resistance to attacks. Nevertheless, in this paper, we investigate membership inference attacks in FD and demonstrate that malicious users can still infer the membership status and even reconstruct the data of the clients in FD. Moreover, we design two black-box membership inference attacks against FD and improve the attack accuracy by using data reconstruction as a pre-attack. Our experimental results show that even without access to model gradients in FD, our method can achieve over 80% attack accuracy on the server side for the EMNIST and CIFAR-100 datasets. We also show that our method can boost attack effectiveness by incorporating data reconstruction as a pre-attack.