A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data

Recently, machine learning has been frequently applied in multiple areas, like image classification and object recognition. However, some machine learning applications train their models on sensitive data that could leak personal information, leading to potential privacy issues. Many privacy attacks against deep learning models have been proposed. A membership inference attack was demonstrated to be a type of effective attack and a real threat to privacy in machine learning. Here, we trained three different convolutional neural networks for image classification with the CIFAR10 dataset and examined the effects of a membership inference attack on these models. We also explore different defense strategies, including differential privacy against membership inference attack. We showed that membership inference attack was more effective against overfitting models and defense strategies like differential privacy and regularization can significantly lower the attack accuracy.

Membership inference attacks can infer whether a data sample exists in the training set of the target model based on limited adversary knowledge, which results in serious leakage of privacy. A large number of recent studies have shown that model overfitting is one of the main reasons why membership inference attacks can be executed successfully. Therefore, some classic methods to solve model overfitting are used to defend against membership inference attacks, such as dropout, spatial dropout, and differential privacy. However, it is difficult for these defense methods to achieve an available trade-off in defense success rate and model utility. In this paper, we focus on the impact of model training loss on model overfitting, and we design a Squeeze-Loss strategy to dynamically find the training loss that achieves the best balance between model utility and privacy. Extensive experimental results show that our strategy can limit the success rate of membership inference attacks to the level of random guesses with almost no loss of model utility, which always outperforms other defense methods.KeywordsMembership inference attackSqueeze training lossDeep learningData privacyDefense strategy

Federated learning provides a solution for data privacy protection, while enabling training over the local data samples, without exchanging them. However, it is far from practical and secure because data privacy is still vulnerable due to the well-studied attacks, e.g., membership inference attacks and model inversion attacks. In this paper, to further prevent data leakage against these attacks, we propose FL-PATE, a differentially private federated learning framework with knowledge transfer. Specifically, participants with sensitive data are grouped to train teacher models under federated learning settings, and the knowledge of teacher models is transferred to a publicly accessible student model for prediction via aggregating teacher models' outputs of public datasets. A modified client-level differential privacy mechanism is used to guarantee each participant's data privacy during the corresponding teacher model's training process. The proposed framework preserves participant's privacy against membership inference attacks and the differential privacy cost is fixed. The privacy analysis and experiments demonstrate that trained teacher and student models have an excellent performance in accuracy and robustness theoretically and empirically.

Federated learning has attracted attention in recent years due to its native privacy-preserving features. However, it is still vulnerable to various membership inference attacks, such as backdoor, poisoning, and adversarial attacks. Membership Inference attack aims to discover the data used to train the model, which leads to privacy leaking ramifications on participants who use their local data to train the shared model. Recent research on countermeasure methods mainly focuses on protecting the parameters and has limitations in guaranteeing privacy while restraining the loss of the model. This paper proposes Fedefend, which applies adversarial examples to defend against membership inference attacks in federated learning. The proposed approach adds well-designed noise to the attack features of the target model of each iteration becomes an adversarial example. In addition, we also consider the utility loss of the model and use an adversarial method to generate noise to constrain the loss to a certain extent, which efficiently achieves a trade-off between privacy security and loss of the federated learning model. We evaluate the proposed Fedefend on two benchmark datasets, and the experimental results demonstrate that Fedefend has a good performance.

Vehicular networking technology using federated learning enhances data privacy and security compared to centralized methods. Yet, it requires further refinement to combat single-point failure and membership inference attacks, privacy concerns, and communication expenses. This paper employs federated differential privacy and blockchain integration to address these challenges, alongside ternary gradient technology and model compression to reduce communication costs. In differential privacy experiments, we have determined that federated differential privacy protection is closer to the accuracy of a no-privacy protection scheme compared to traditional differential privacy protection, especially when C ≥ 2. In ternary gradient experiments, we observed a reduction in training gradients of 14.99×, 15.54×, and 15.97× across three datasets. In layer sensitivity experiments, we found that the accuracy at top = 97%, 94%, and 91% is comparable to that at top = 100% (uncompressed). In blockchain experiments, The training effects and overall trends of blockchain models are similar to those of non-blockchain models.

While location data is extremely valuable for various applications, disclosing it prompts serious threats to individuals' privacy. To limit such concerns, organizations often provide analysts with aggregate time-series that indicate, e.g., how many people are in a location at a time interval, rather than raw individual traces. In this paper, we perform a measurement study to understand Membership Inference Attacks (MIAs) on aggregate location time-series, where an adversary tries to infer whether a specific user contributed to the aggregates. We find that the volume of contributed data, as well as the regularity and particularity of users' mobility patterns, play a crucial role in the attack's success. We experiment with a wide range of defenses based on generalization, hiding, and perturbation, and evaluate their ability to thwart the attack vis-à-vis the utility loss they introduce for various mobility analytics tasks. Our results show that some defenses fail across the board, while others work for specific tasks on aggregate location time-series. For instance, suppressing small counts can be used for ranking hotspots, data generalization for forecasting traffic, hotspot discovery, and map inference, while sampling is effective for location labeling and anomaly detection when the dataset is sparse. Differentially private techniques provide reasonable accuracy only in very specific settings, e.g., discovering hotspots and forecasting their traffic, and more so when using weaker privacy notions like crowd-blending privacy. Overall, our measurements show that there does not exist a unique generic defense that can preserve the utility of the analytics for arbitrary applications, and provide useful insights regarding the disclosure of sanitized aggregate location time-series.

Federated learning (FL) enables decentralized, privacy-preserving machine learning by training models across distributed data without sharing raw patient information. However, most FL frameworks focus on unimodal data and overlook critical challenges in multimodal healthcare settings, such as privacy risks, fairness disparities, and reduced model interpretability. We present PRIFLEX (Privacy-Resilient Integration Framework for Learning Exchange), a novel FL framework designed for secure integration of structured and unstructured medical data. PRIFLEX combines 12-lead electrocardiograms (ECG) from the PhysioNet PTB-XL dataset and clinical notes from the Medical Information Mart for Intensive Care IV (MIMIC-IV), supporting early, late, and hybrid data fusion strategies. To safeguard model updates, it evaluates standalone and hybrid defenses using Differential Privacy (DP) and Secure Aggregation (SA) against gradient leakage, model inversion, and membership inference attacks. Results show that early fusion improves the area under the Receiver Operating Characteristic curve (AUROC) by up to 6.2%, while hybrid DP+SA reduces attack success rates by up to 84% and improves fairness with manageable system overhead. PRIFLEX also quantifies interpretability loss using SHapley Additive exPlanations (SHAP) and gradient-based methods, highlighting the trade-off between privacy and transparency. Overall, PRIFLEX sets a new benchmark for building secure, fair, and explainable federated learning systems in healthcare.

Stock price forecasting remains a central challenge in financial modeling due to the non-stationarity, noise, and high dimensionality of market dynamics, as well as the growing importance of unstructured textual information. In this work, we propose a multimodal prediction framework that combines FinBERT-based financial sentiment extraction with technical and statistical indicators to forecast short-term stock price movement. Contextual sentiment signals are derived from financial news headlines using FinBERT, a domain-specific transformer model fine-tuned on annotated financial text. These signals are aggregated and fused with price- and volatility-based features, forming the input to a gradient-boosted decision tree classifier (XGBoost). To ensure interpretability, we employ SHAP (SHapley Additive exPlanations), which decomposes each prediction into additive feature attributions while satisfying game-theoretic fairness axioms. In addition, we integrate differential privacy into the training pipeline to ensure robustness against membership inference attacks and protect proprietary or client-sensitive data. Empirical evaluations across multiple S&P 500 equities from 2018–2023 demonstrate that our FinBERT-enhanced model consistently outperforms both technical-only and lexicon-based sentiment baselines in terms of AUC, F1-score, and simulated trading profitability. SHAP analysis confirms that FinBERT-derived features rank among the most influential predictors. Our findings highlight the complementary value of domain-specific NLP and privacy-preserving machine learning in financial forecasting, offering a principled, interpretable, and deployable solution for real-world quantitative finance applications.

We consider the problem of membership inference attacks on aggregate survey data through the use of several real-world datasets and a published study as a model for the survey. We apply membership inference attacks from the literature, and discover that methodological assumptions of existing attacks produce a misleading picture of the risk. When using a more realistic methodology, experiments reveal a more nuanced picture of the risk: membership inferences do succeed, but only a small subset of individuals are highly vulnerable to them. In fact, if the adversary wishes to avoid a high false positive rate, she should perform membership inferences only when she has a reason to believe that the target participated in the survey. However, our results do not imply that publishing survey data is inherently safe. Indeed, when applying membership inference not to individuals but to hospitals, we find that highly accurate inferences are possible.

Location data can be extremely useful to study commuting patterns and disruptions, as well as to predict real-time traffic volumes. At the same time, however, the fine-grained collection of user locations raises serious privacy concerns, as this can reveal sensitive information about the users, such as, life style, political and religious inclinations, or even identities. In this paper, we study the feasibility of crowd-sourced mobility analytics over aggregate location information: users periodically report their location, using a privacy-preserving aggregation protocol, so that the server can only recover aggregates - i.e., how many, but not which, users are in a region at a given time. We experiment with real-world mobility datasets obtained from the Transport For London authority and the San Francisco Cabs network, and present a novel methodology based on time series modeling that is geared to forecast traffic volumes in regions of interest and to detect mobility anomalies in them. In the presence of anomalies, we also make enhanced traffic volume predictions by feeding our model with additional information from correlated regions. Finally, we present and evaluate a mobile app prototype, called Mobility Data Donors (MDD), in terms of computation, communication, and energy overhead, demonstrating the real-world deployability of our techniques.

While machine learning has achieved tremendous success, the privacy security of its models faces challenges. To protect the privacy of machine learning models, researchers have proposed methods such as federated learning and differential privacy. However, the effectiveness of these methods in defending against attacks on model privacy at the practical level has not been comprehensively evaluated. In this paper, we focus on membership inference attacks targeting the privacy of machine learning models. By employing classical black-box membership inference attacks and a white-box membership inference attack proposed in this paper, we evaluate the privacy performance of the federated differential privacy framework in scenarios where privacy attacks are actively defended. Experimental results demonstrate that compared to centralized learning with differential privacy methods, models trained using the federated differential privacy framework exhibit stronger privacy performance and higher utility. We investigate the impact of differential privacy implementation mechanisms and privacy budgets on the privacy performance of federated learning models, providing insights and guidance for selecting critical privacy mechanisms and parameters in the practical application of the federated differential privacy framework.

This paper considers the problem of secure data aggregation (mainly summation) in a distributed setting, while ensuring differential privacy of the result. We study secure multiparty addition protocols using well known security schemes: Shamir's secret sharing, perturbation-based, and various encryptions. We supplement our study with our new enhanced encryption scheme EFT, which is efficient and fault tolerant. Differential privacy of the final result is achieved by either distributed Laplace or Geometric mechanism (respectively DLPA or DGPA), while approximated differential privacy is achieved by diluted mechanisms. Distributed random noise is generated collectively by all participants, which draw random variables from one of several distributions: Gamma, Gauss, Geometric, or their diluted versions. We introduce a new distributed privacy mechanism with noise drawn from the Laplace distribution, which achieves smaller redundant noise with efficiency. We compare complexity and security characteristics of the protocols with different differential privacy mechanisms and security schemes. More importantly, we implemented all protocols and present an experimental comparison on their performance and scalability in a real distributed environment. Based on the evaluations, we identify our security scheme and Laplace DLPA as the most efficient for secure distributed data aggregation with privacy.

For many, mapping platforms are enmeshed in everyday experiences. We navigate, locate, and move through the world with the help of their locative affordances. Consequently, these platforms have an intimate awareness of our movements and location history, and this information is valuable for advertisers. One way that platforms can track and share this information is through geofences, commonly used by companies to send targeted advertisements directly to platforms. Geofences are virtual perimeters established around target locations that act as a digital tripwire, marking who and what crosses its threshold. Digital mapping platforms like Google Maps broker this location data to third-parties (Bui, Chang, & McIlwain, 2022). This paper examines two applications of geofences as intermediaries of locational data. The first is the use of geofences by the property platform, CIVVL, that applies geofences to facilitate and accelerate the tenant eviction process. The second is Hawk Analytics, a locational data broker that geofences abortion clinics and sells the locational data from the clinic’s clients to anti-choice organizations, in jurisdictions of the United States where such healthcare is illegal. In our analysis of locational data, we apply the concept of platform intimacies (Rambukkana and de Verteuil, 2021; Ley, & Rambukkana, 2021) to understand the techniques through which geofences access private locational details. This paper examines the spatial relations the geofence enforces and how this often-unregulated informational infrastructure can be applied to weaponize location data. We argue that the geofence enables an extractive relationship with intimate platform knowledge while it enforces hegemonic notions of trespass and belonging.

In this paper, we focus on the privacy preserving mechanism design for crowdsourced Federated Learning (FL), where a requester can outsource its model training task to some workers via an FL platform. A potential way to preserve the privacy of workers' local data is to leverage Differential Privacy (DP) mechanisms on local models. However, most of these studies cannot allow workers to dominate their own privacy protection levels by themselves. Thus, we propose a Personalized Privacy Preserving Mechanism, called P3M, to satisfy the heterogeneous privacy needs of workers, which consists of two parts. The first part includes a personalized privacy budget determination problem. We model it as a two-stage Stackelberg game, derive the personalized privacy budget for each worker and the optimal payment for the requester, and prove that they form a unique Stackelberg equilibrium. Second, we design a dynamic perturbation scheme to perturb model parameters. Through the theoretical analysis, we prove that P3M satisfies the desired DP property, and derive the bounds of the variance of average perturbed parameters and the convergence upper bound. This demonstrates that the global model accuracy can be controllable and P3M is endowed with the satisfactory convergence performance. In addition, we extend our problem to the scenario where the total privacy budget of all workers is limited, so as to prevent some workers from setting exorbitant privacy budgets. Under the privacy constraint, we re-determine the personalized privacy budget for each worker. Finally, exhaustive simulations of P3M are conducted based on real-world datasets, and the experimental results corroborate its effectiveness and practicability.

Mobile crowdsensing applications can learn the aggregate statistics over personal data to produce useful knowledge about the world. Since personal data may be privacy-sensitive, the aggregator should only gain desired statistics without learning anything about the personal data. Differential privacy, the state-of-the-art privacy mechanism, can provide strong protection to ensure parties' privacy in such scenarios. Correspondingly, based on the differential privacy, many collusion-tolerant aggregation schemes have been proposed. However, those collusion-tolerant schemes usually incur high accumulated error and also require the priori knowledge of the fraction of those colluded parties. In this paper, we propose a differential-private collusion-tolerant aggregation protocol, while incurring no additionally error except the noise required for providing the differential privacy guarantee. Another salient characteristic of the proposed protocol is that it need not to have an priori estimation of those colluded parties. In addition, we also design an efficient aggregation encryption scheme to support those mobile crowdsensing applications where large plaintext is required. We also make some extensions to make the proposed protocol more applicable in realities, such as the fault tolerant. The analysis shows that the proposed protocol can achieve desired goals, and the performance evaluation demonstrates the protocol's efficiency in reality.