Exploiting Unintended Feature Leakage in Collaborative Learning
This reveals a critical privacy vulnerability in collaborative and federated learning systems, impacting users who rely on these techniques for data protection.
The paper demonstrates that collaborative learning leaks unintended information about participants' training data, enabling attacks to infer specific data points (e.g., membership inference) and properties independent of the model's goals, with evaluations across various tasks and datasets.
Collaborative machine learning and related techniques such as federated learning allow multiple participants, each with his own training dataset, to build a joint model by training locally and periodically exchanging model updates. We demonstrate that these updates leak unintended information about participants' training data and develop passive and active inference attacks to exploit this leakage. First, we show that an adversarial participant can infer the presence of exact data points -- for example, specific locations -- in others' training data (i.e., membership inference). Then, we show how this adversary can infer properties that hold only for a subset of the training data and are independent of the properties that the joint model aims to capture. For example, he can infer when a specific person first appears in the photos used to train a binary gender classifier. We evaluate our attacks on a variety of tasks, datasets, and learning configurations, analyze their limitations, and discuss possible defenses.