Work

The Geometry of Privacy: A Two-Stage Analysis of Generative Membership Inference in Federated Learning

Year: 2026

Type: article

Abstract: We study Membership Inference Attack (MIA) risk in Federated Learning through a two-stage lens that separates (i) whether a target client’s contribution is detectable after aggregation and system noise (Stage I: Signal Survival) from (ii) whether a surviving contribution induces a generative membership score change attributable to the target’s private data (Stage II: Signal Attribution). Stage I models aggregation as a target–background decomposition and shows that detectability hinges on target–background alignment, which can induce cancellation. Stage II connects the surviving target component to a generative MIA score via a local path representation and Lipschitz/smoothness bounds, avoiding architecture-specific assumptions. Our analysis reveals that the leading attribution term is governed by the alignment between the target update and the score geometry of the target data at an appropriate baseline. We validate the theoretical bounds and illustrate risk trajectories across several scenarios.

Source: Big Data and Cognitive Computing

DOI: 10.3390/bdcc10050163

Authors: Borja Arroyo Galende, Patricia A. Apellániz, Alejandro Almodóvar, Silvia Uribe, Federico Álvarez, Juan Parras

Institutions: Information Processing and Telecommunications Center, Universidad Politécnica de Madrid

Language: English

Topic: Privacy-Preserving Technologies in Data

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,172

Funder: HORIZON EUROPE Framework Programme