Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks

• URL: http://arxiv.org/abs/2609.02971v2
• Date: Sat, 05 Sep 2026 10:06:01 GMT
• Title: Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks
• Abstract summary: We study server-side client identity inference from transmitted weight deltas.<n>We quantify the privacy-utility trade-off of a lightweight clip-then-noise defense.
• Score: 1.656436183201117
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with near-perfect accuracy (approximately 1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacy-utility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (sigma in {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C=1.0), and report formal (epsilon, delta)-DP budgets through Renyi accounting. A practical region (sigma in [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA-256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require.

Related papers

• FedAttr: Towards Privacy-preserving Client-Level Attribution in Federated LLM Fine-tuning [58.80511162314259]
  We propose FedAttr, a new client-level attribution protocol for federated learning.<n>FedAttr identifies which clients trained on watermarked data via a paired-subset-difference mechanism.<n>It achieves 100% TPR and 0% FPR, outperforming all baselines by at least 44.4% in TPR or 19.1% in FPR, with only 6.3% overhead relative to FL training time.
  arXiv  Detail & Related papers  (2026-05-07T17:21:02Z)
• CyberCane: Neuro-Symbolic RAG for Privacy-Preserving Phishing Detection with Formal Ontology Reasoning [14.077535013043311]
  CyberCane is a neuro-symbolic framework integrating.<n> deterministic symbolic analysis with privacy-preserving.<n>retrieval-augmented generation (RAG)<n>PhishOnt is an OWL enabling verifiable attack classification through formal reasoning chains.
  arXiv  Detail & Related papers  (2026-04-26T07:08:00Z)
• Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach [44.738736515079346]
  Federated Large Language Models (FedLLMs) enable multiple parties to collaboratively fine-tune LLMs without sharing raw data.<n>FedLLMs' unique properties, i.e. massive parameter scales, rapid convergence, and sparse, non-orthogonal gradients, render existing MIAs ineffective.<n>We propose ProjRes, the first projection residuals-based passive MIA tailored for FedLLMs.
  arXiv  Detail & Related papers  (2026-04-23T01:44:04Z)
• Repurposing Backdoors for Good: Ephemeral Intrinsic Proofs for Verifiable Aggregation in Cross-silo Federated Learning [30.440611659881494]
  We propose a lightweight architecture that shifts from cryptographic proofs to textitIntrinsic Proofs<n>We harness Catastrophic Forgetting to embed verification signals directly into model parameters.<n>Our approach achieves over $1000times$ speedup on ResNet-18 compared to cryptographic baselines, effectively scaling to large models.
  arXiv  Detail & Related papers  (2026-03-11T12:04:18Z)
• RAIN: Secure and Robust Aggregation under Shuffle Model of Differential Privacy [46.52109845749167]
  We present Robust Aggregation in Noise (RAIN), a framework that reconciles privacy, robustness, and verifiability under Shuffle-DP.<n>RAIN adopts sign-space aggregation to robustly measure update consistency and limit malicious influence under noise and anonymization.<n>We show that RAIN maintains strong privacy guarantees under Shuffle-DP and remains robust to poisoning attacks with negligible degradation in accuracy and convergence.
  arXiv  Detail & Related papers  (2026-03-03T15:41:54Z)
• ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Data [50.142067708131826]
  Federated Instruction Tuning (FIT) enables collaborative instruction tuning of large language models across multiple organizations (clients) in a cross-silo setting without requiring the sharing of private instructions.<n>Recent findings suggest that poisoned samples may be pervasive and inadvertently embedded in real-world datasets, potentially distributed across all clients, even if the clients are benign.<n>This paper introduces ProtegoFed, the first backdoor-free FIT framework that accurately detects, purifies, and even interspersed poisoned data across clients during the training.
  arXiv  Detail & Related papers  (2026-02-28T07:25:32Z)
• FedGraph-VASP: Privacy-Preserving Federated Graph Learning with Post-Quantum Security for Cross-Institutional Anti-Money Laundering [0.0]
  We present FedGraph-VASP, a privacy-generative graph learning framework for anti-money laundering detection.<n>Our key contribution is a Boundary Embedding Exchange protocol that shares only compressed, non-invertible graph neural network representations of boundary accounts.
  arXiv  Detail & Related papers  (2026-01-25T18:14:26Z)
• ACCESS-FL: Agile Communication and Computation for Efficient Secure Aggregation in Stable Federated Learning Networks [26.002975401820887]
  Federated Learning (FL) is a distributed learning framework designed for privacy-aware applications. Traditional FL approaches risk exposing sensitive client data when plain model updates are transmitted to the server. Google's Secure Aggregation (SecAgg) protocol addresses this threat by employing a double-masking technique. We propose ACCESS-FL, a communication-and-computation-efficient secure aggregation method.
  arXiv  Detail & Related papers  (2024-09-03T09:03:38Z)
• Decaf: Data Distribution Decompose Attack against Federated Learning [4.3667223256713745]
  We devise an innovative privacy threat: the Data Distribution Decompose Attack on FL, termed Decaf. Decaf operates stealthily, rendering it entirely passive and undetectable to victim users regarding the infringement of their data distribution privacy. Results indicate its ability to accurately decompose local user data distribution, regardless of whether it is IID or non-IID distributed.
  arXiv  Detail & Related papers  (2024-05-24T07:56:32Z)
• Client-side Gradient Inversion Against Federated Learning from Poisoning [59.74484221875662]
  Federated Learning (FL) enables distributed participants to train a global model without sharing data directly to a central server. Recent studies have revealed that FL is vulnerable to gradient inversion attack (GIA), which aims to reconstruct the original training samples. We propose Client-side poisoning Gradient Inversion (CGI), which is a novel attack method that can be launched from clients.
  arXiv  Detail & Related papers  (2023-09-14T03:48:27Z)
• CrowdGuard: Federated Backdoor Detection in Federated Learning [39.58317527488534]
  This paper presents a novel defense mechanism, CrowdGuard, that effectively mitigates backdoor attacks in Federated Learning. CrowdGuard employs a server-located stacked clustering scheme to enhance its resilience to rogue client feedback. The evaluation results demonstrate that CrowdGuard achieves a 100% True-Positive-Rate and True-Negative-Rate across various scenarios.
  arXiv  Detail & Related papers  (2022-10-14T11:27:49Z)
• Over-the-Air Federated Learning with Privacy Protection via Correlated Additive Perturbations [57.20885629270732]
  We consider privacy aspects of wireless federated learning with Over-the-Air (OtA) transmission of gradient updates from multiple users/agents to an edge server. Traditional perturbation-based methods provide privacy protection while sacrificing the training accuracy. In this work, we aim at minimizing privacy leakage to the adversary and the degradation of model accuracy at the edge server.
  arXiv  Detail & Related papers  (2022-10-05T13:13:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.