Skip to main content

Table 2 Privacy inference attacks against FL in the training phase

From: Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives

 

Assumption

Goal

Limitation

Adversary

Active/Passive

Auxiliary data

GAN attack (Hitaj et al. 2017)

Worker

Active

No

Classrepresentative inference

Allclassmembers similar

CPA (Nasr et al. 2019)

Worker

Active/Passive

No

Membershipinference

Lackstheoretical proofofthebounds

UFL (Melis et al. 2019)

Worker

Active/Passive

Yes

Propertiesinference

Auxiliarycondition maynotmeet

DLG (Zhu and Han 2020)

Server

Passive

No

Inferringtraining dataandlabel

Shallowand smoothnetworks

iDLG (Zhao et al. 2020)

Server

Passive

No

Inferringtrainingdata withimagelabelrecovery

Asingleinput point

Invert gradient (Geiping et al. 2020)

Server

Passive

No

Inferringtraining dataandlabel

Lowperformance atgeneralcase

GradInversion (Yin et al. 2021)

Server

Passive

No

Largebatchimagerecovery forcomplexdatasets

Gradientsonlyupdate onceatlocal ineachiteration

GRNN (Ren et al. 2021)

Server

Passive

No

Generatingtraining dataandlabel