{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/secure-aggregation-is-not-private-against","title":"Secure Aggregation is Not Private Against Membership Inference Attacks","arxiv_id":"2403.17775","date":"2024-03-26","proceeding":null,"authors":["Khac-Hoang Ngo","Johan Östman","Giuseppe Durisi","Alexandre Graell i Amat"],"abstract":"Secure aggregation (SecAgg) is a commonly-used privacy-enhancing mechanism in federated learning, affording the server access only to the aggregate of model updates while safeguarding the confidentiality of individual updates. Despite widespread claims regarding SecAgg's privacy-preserving capabilities, a formal analysis of its privacy is lacking, making such presumptions unjustified. In this paper, we delve into the privacy implications of SecAgg by treating it as a local differential privacy (LDP) mechanism for each local update. We design a simple attack wherein an adversarial server seeks to discern which update vector a client submitted, out of two possible ones, in a single training round of federated learning under SecAgg. By conducting privacy auditing, we assess the success probability of this attack and quantify the LDP guarantees provided by SecAgg. Our numerical results unveil that, contrary to prevailing claims, SecAgg offers weak privacy against membership inference attacks even in a single training round. Indeed, it is difficult to hide a local update by adding other independent local updates when the updates are of high dimension. Our findings underscore the imperative for additional privacy-enhancing mechanisms, such as noise injection, in federated learning.","url_abs":"https://arxiv.org/abs/2403.17775v3","url_pdf":"https://arxiv.org/pdf/2403.17775v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"secure-aggregation-is-not-private-against","repo_url":"https://github.com/khachoang1412/SecAgg_not_private","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}}],"tasks":[{"task_slug":"federated-learning","task_name":"Federated Learning"},{"task_slug":"privacy-preserving","task_name":"Privacy Preserving"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2403.17775","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2403.17775"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/khachoang1412/SecAgg_not_private","reach":{"status":"ok"}}],"summary":{"ran":2,"unverified":1},"by_repo_kind":{"official":{"samples":3,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"1ddbdbb086691410","entry":"logPDF_Gaussian","repo":"khachoang1412/SecAgg_not_private","repo_kind":"official","path":"privacy_auditing.py","file_url":"https://github.com/khachoang1412/SecAgg_not_private/blob/HEAD/privacy_auditing.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1ddbdbb086691410"}},{"code_sha256_prefix":"66d4ebc331e35ad1","entry":"logPDF_Gaussian_EVD","repo":"khachoang1412/SecAgg_not_private","repo_kind":"official","path":"privacy_auditing.py","file_url":"https://github.com/khachoang1412/SecAgg_not_private/blob/HEAD/privacy_auditing.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"66d4ebc331e35ad1"}},{"code_sha256_prefix":"4062c87dc9f0fbc4","entry":"data_load","repo":"khachoang1412/SecAgg_not_private","repo_kind":"official","path":"privacy_auditing.py","file_url":"https://github.com/khachoang1412/SecAgg_not_private/blob/HEAD/privacy_auditing.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4062c87dc9f0fbc4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}