## 3 Privacy Attacks in FL
### Membership Inference  
Membership inference is a type of attack in machine learning that aims to figure out whether a target data point is used to train a certain ML model. More formally, given \(x\) as the target point, \(M\) as a trained model, and some external knowledge \(K\), this attack can be defined by the following function  
\[A:x,M,K\rightarrow\{False,True\}\]  
Here, this function returns \(True\) if the target \(x\) is in the training dataset and \(False\) otherwise. This attack can be made either in a black-box setting, where the attacker has only access to an API of the model \(M\), or in a white-box setting, where the attacker has access to the whole model. As we can remark, the attack model \(A\) is a binary classifier, and it can be constructed using different ways. The first membership inference attack against machine learning models was presented by [PERSON] et al. in 2017 [PERSON] et al. (2017). In this work, they consider a black-box setting and try to exploit the fact that ML models have a different behavior on the data they were trained on and the data that they see for the first time. In other words, they are modeling the membership inference problem as a problem of binary classification and try to train a model that distinguishes members from non-members of the target model. The idea of this  
Figure 1: Attacks on the federated learning process [PERSON] et al. (2017). work is to train the attack model using a shadow training technique (that was introduced in this work). They construct multiple shadow models that mimic the behavior of the target model, but for which the training set is known and have the same structure. [PERSON] et al. proposed some methods to generate the shadow training data and then the method used to train the attack model. The proposed attack was evaluated against neural networks using different datasets: CIFAR, Purchases, Locations, Texas hospital stays, MNIST, and UCI Adult. The authors confirm that their results show that models created using MLaaS can leak a lot of information about their training datasets. The assumptions considered by [PERSON] et al. are considered strong, which reduce the scope of the membership inference attack [34]. This motivated [PERSON] et al. in 2019 [34] to propose relaxations of these assumptions. They showed that relaxing the number of shadow models to one shadow model and assuming that the shadow training data are distributed similarly to target training data produce performances that are similar to those provided by [PERSON] et al. [33]. Furthermore, considering an attack model that is independent of the training data distribution may also reveal some information, but this is not as efficient as in the previous work. The two previous works focus on general machine learning (ML) models, but it is important to consider the unique characteristics of federated learning, which may present a larger attack surface [35]. [PERSON] and [PERSON] in 2020 [35] demonstrated that membership attacks performed by an insider in a sequential federated learning setting are more effective compared to centralized settings. Unlike the work of [PERSON] et al. [33] that examines black-box attacks, in the federated learning setting, an insider attacker has knowledge of the model's architecture, making the attack more efficient. Additionally, if multiple insider attackers collaborate, the attack can become more sophisticated. [PERSON] et al. [36] further assert that, through Membership Inference Attacks (MIA), adversaries can even infer which participant possesses the data. The authors demonstrate that an honest-but-curious server can estimate the data source without violating federated learning protocols. In 2019, [PERSON] et al. [37] introduced a comprehensive Membership Inference Attack (MIA) that targets the privacy vulnerabilities of the stochastic gradient descent (SGD) algorithm within the context of federated learning.