🤖 AI Summary
This work addresses the privacy risk in federated learning where black-box models may still leak membership information about training data. The authors propose a training-free black-box membership inference attack that exploits differences in model sensitivity to high-frequency details induced by varying input resolutions. By applying controlled downsampling and upsampling operations to simulate resolution degradation, the method analyzes the resulting divergence in prediction confidence decay between member and non-member samples to infer membership status. Notably, the attack requires neither shadow models, auxiliary datasets, nor additional training—only a small number of forward queries. Evaluated on a federated ResNet-18 trained on CIFAR-10, the approach achieves an AUC of 0.88, substantially outperforming existing training-free baselines while incurring minimal computational overhead.
📝 Abstract
Membership inference attacks (MIAs) pose a serious threat to the privacy of machine learning models by allowing adversaries to determine whether a specific data sample was included in the training set. Although federated learning (FL) is widely regarded as a privacy-aware training paradigm due to its decentralized nature, recent evidence shows that the final global model can still leak sensitive membership information through black-box access. In this paper, we introduce Res-MIA, a novel training-free and black-box membership inference attack that exploits the sensitivity of deep models to high-frequency input details. Res-MIA progressively degrades the input resolution using controlled downsampling and restoration operations, and analyzes the resulting confidence decay in the model's predictions. Our key insight is that training samples exhibit a significantly steeper confidence decline under resolution erosion compared to non-member samples, revealing a robust membership signal. Res-MIA requires no shadow models, no auxiliary data, and only a limited number of forward queries to the target model. We evaluate the proposed attack on a federated ResNet-18 trained on CIFAR-10, where it consistently outperforms existing training-free baselines and achieves an AUC of up to 0.88 with minimal computational overhead. These findings highlight frequency-sensitive overfitting as an important and previously underexplored source of privacy leakage in federated learning, and emphasize the need for privacy-aware model designs that reduce reliance on fine-grained, non-robust input features.