Evaluating Differential Privacy Against Membership Inference in Federated Learning: Insights from the NIST Genomics Red Team Challenge

Gustavo de Carvalho Bertoli

cs.CRApr 14, 2026

Evaluating Differential Privacy Against Membership Inference in Federated Learning: Insights from the NIST Genomics Red Team Challenge

Authors: Gustavo de Carvalho Bertoli

Abstract

While Federated Learning (FL) mitigates direct data exposure, the resulting trained models remain susceptible to membership inference attacks (MIAs). This paper presents an empirical evaluation of Differential Privacy (DP) as a defense mechanism against MIAs in FL, leveraging the environment of the 2025 NIST Genomics Privacy-Preserving Federated Learning (PPFL) Red Teaming Event. To improve inference accuracy, we propose a stacking attack strategy that ensembles seven black-box estimators to train a meta-classifier on prediction probabilities and cross-entropy losses. We evaluate this methodology against target models under three privacy configurations: an unprotected convolutional neural network (CNN, $ε=\infty$ ), a low-privacy DP model ( $ε=200$ ), and a high-privacy DP model ( $ε=10$ ). The attack outperforms all baselines in the No DP and Low Privacy settings and, critically, maintains measurable membership leakage at $ε=200$ where a single-signal LiRA baseline collapses. Evaluated on an independent third-party benchmark, these results provide an empirical characterisation of how stacking-based inference degrades across calibrated DP tiers in FL.

Figures & tables

Figure 1: Problem setting. Clients train local models on private genomic data and share them with a central aggregator. The adversary queries client models and uses auxiliary data (relevant, external, challenge) to execute MIA.

Target	Relevant Records	External Records
Client 1	73	64
Client 2	95	83
Client 3	59	52
Client 4	23	20
Challenge Records	73 (evaluated collectively)
Feature Space	125,767 gene variants

Table 1: Distribution of Auxiliary and Challenge Records per Target Client

Panel of Figure 2 — Figure 2: Architectural comparison across privacy tiers. Batch Normalization (Non-DP CNN) is replaced by Layer Normalization in DP-enabled models to satisfy per-sample gradient clipping requirements.

Panel of Figure 3 — Figure 3: Schematic effect of DP noise on member/non-member loss distributions. Without DP the distributions are well separated (left); as $\epsilon$ decreases, noise progressively closes the gap that MIAs exploit (right).

Panel of Figure 4 — Figure 4: Ensemble MIA inference pipeline. Solid arrows show the forward pass of a challenge record $X$ through the target FL model, seven ART base estimators, and the XGBoost meta-classifier. The dashed path denotes offline domain adaptation on known non-members, yielding the per-client noise floor $P^{(c)}_{thr}$ ; assignment requires both column ( $P>P^{(c)}_{thr}$ ) and row ( $P>1.5\,\bar{P}(X)$ ) conditions.

	Accuracy on Challenge Records (%)
	No DP	Low Privacy ( $\epsilon=200$ )	High Privacy ( $\epsilon=10$ )
This work	53.42	38.36	24.66
Baseline 1	26.03	28.77	26.03
Baseline 2 4 4 4 The Baseline 2, also developed by the author, is an oversimplification of the LiRA [ 5 ] . Instead of training extensive shadow models to estimate per-example hardness as in canonical LiRA, this lightweight adaptation leveraged the provided external records to establish a baseline out-of-distribution (non-member) profile for each client model. Specifically, the attack computed the mean cross-entropy loss and mean prediction confidence across the external dataset. A challenge record was then inferred as a member if its evaluated loss was strictly lower than the mean external loss and its confidence exceeded the mean external confidence, ultimately assigning the record to the client model that yielded the highest confidence score. This heuristic mirrors the confidence-based attack of Salem et al. [ 18 ] .	30.14	20.55	26.03
Baseline 3	27.4	26.03	20.55
Baseline 4	26.03	19.18	27.4

Table 2: MIA methodologies on the Challenge Set (third-party evaluation)

Panel of Figure 5 — Figure 5: Attack accuracy across privacy tiers. Under High Privacy ( $\epsilon=10$ ), several baselines score comparably to this work, consistent with the distribution-merging effect shown in Figure 3 . Random assignment ( $\approx$ 26%) provides a lower bound.

Privacy Tier	Target FPR	This work	LiRA
No DP (CNN)	$\leq 1.00\%$	46.15%	92.31%
No DP (CNN)	$\leq 3.00\%$	100.00%	100.00%
Low DP ( $\epsilon=200$ )	$\leq 1.00\%$	30.77%	0.00%
Low DP ( $\epsilon=200$ )	$\leq 3.00\%$	38.46%	7.69%
High DP ( $\epsilon=10$ )	$\leq 1.00\%$	0.00%	0.00%
High DP ( $\epsilon=10$ )	$\leq 3.00\%$	0.00%	0.00%

Table 3: TPR at fixed FPR thresholds on Client 4 (

N_{IN}=13

N_{OUT}=103

Figure 6: Per-round classification accuracy over 50 FL rounds across three privacy tiers and local epoch settings. The red dashed line marks the 4-class random assignment floor (

\approx

25%).

	FL Setting	Black-Box Only	Shadow-Model-Free	Multi-Signal Ensemble	Calibrated DP Evaluation	TPR at Low FPR	Third-Party Benchmark
Shokri et al. [ 21 ]	○	●	○	○	○	○	○
Yeom et al. [ 24 ]	○	●	●	○	○	○	○
Salem et al. [ 18 ]	○	●	●	○	○	○	○
Nasr et al. [ 14 ]	●	○	●	○	○	○	○
Jayaraman & Evans [ 10 ]	○	●	◐	○	◐	○	○
Carlini et al. [ 5 ]	○	◐	○	○	◐	●	○

Table 4: Positioning of this work relative to prior MIA studies. ● = fully addressed, ◐ = partially addressed, ○ = not addressed.

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 111 papers

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning
Jun 15, 2026Xiaolin Li, Ning Wang, Ninghui Li +1Backdoor Attacks in Federated Learning Differentially Private Federated Learning
Purdue University West Lafayette, IN, USA · University of South Florida Tampa, FL, USA
Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning
Jan 10, 2026Quan Minh Nguyen, Min-Seon Kim, Hoang M. Ngo +3Membership Inference Attacks Federated Fine-Tuning
CISE, University of Florida, FL, USA · North Carolina State University, NC, USA · Washington State University, WA, USA +1
Mitigating Membership Inference in Intermediate Representations with Differentially Private Training
Feb 26, 2026Jiayang Meng, Tao Huang, Chen Hou +2Differentially Private Stochastic Gradient Descent Membership Inference Attacks
School of Information, Renmin University of China, Beijing, China · School of Computer Science and Big Data, Minjiang University, Fuzhou, Fujian, China

Jun 15, 2026J/K move · Enter open · S save

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning

Xiaolin Li, Ning Wang, Ninghui Li, Wenhai Sun

Purdue University West Lafayette, IN, USA · University of South Florida Tampa, FL, USA

Backdoor Attacks in Federated Learning Differentially Private Federated Learning Differential Privacy Federated Learning

Open paper AskPDF arXiv

Prior research suggests that differential privacy (DP) can enhance the robustness of federated learning (FL) against backdoor attacks. In this paper, we challenge this assumption. Through an empirical analysis of two baseline attack strategies, we uncover a fundamental tension in DP-FL: while bypassing DP allows state-of-the-art defenses to detect and filter malicious updates, complying with DP inadvertently masks their distinguishing statistical characteristics. Consequently, existing defenses become ineffective as DP reduces the raw backdoor signal. Building on this masking effect, we propose RING, a novel attack that explicitly exploits DP to conceal malicious contributions while maximizing attack impact. By collaboratively crafting adversarial perturbations, compromised clients reconstruct a strong backdoor signal during aggregation without triggering anomaly detection. RING operates as a perturbation layer that is agnostic to the underlying backdoor technique, making it broadly applicable and composable with existing attacks -- a property that significantly amplifies the threat it poses to DP-FL. Extensive evaluations across four image and text datasets under non-iid distributions show that RING achieves an average attack success rate of 90.3% against six state-of-the-art defenses under a moderate privacy budget, an improvement of up to 38.4% over baseline strategies. Finally, we evaluate potential countermeasures and find that mitigating this threat incurs significant utility trade-offs, exposing a fundamental security gap in the deployment of differentially private FL.

Abstract

Membership Inference Attacks

Explore similar work

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning

Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning

Mitigating Membership Inference in Intermediate Representations with Differentially Private Training