Leveraging Membership Inference Attacks for Privacy Measurement in Federated Learning for Remote Sensing Images

2026-01-08

arXiv.org

AI Summary

This work addresses the privacy risks in federated learning for remote sensing imagery, where raw data remain protected but model outputs may still leak membership information, and effective privacy quantification remains lacking. For the first time, we introduce a black-box membership inference attack (MIA) framework to this domain, employing entropy-based, refined entropy, and likelihood ratio attacks to evaluate privacy leakage across multiple federated algorithms and communication strategies on public remote sensing datasets. Our experiments demonstrate that MIA effectively uncovers privacy vulnerabilities not reflected by model accuracy alone. Furthermore, communication-efficient federated strategies significantly reduce MIA success rates while preserving model utility, thereby validating their efficacy both as a privacy metric and as a practical means to enhance privacy preservation.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Bias, Fairness & Privacy
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Federated Learning (FL) enables collaborative model training while keeping training data localized, allowing us to preserve privacy in various domains including remote sensing. However, recent studies show that FL models may still leak sensitive information through their outputs, motivating the need for rigorous privacy evaluation. In this paper, we leverage membership inference attacks (MIA) as a quantitative privacy measurement framework for FL applied to remote sensing image classification. We evaluate multiple black-box MIA techniques, including entropy-based attacks, modified entropy attacks, and the likelihood ratio attack, across different FL algorithms and communication strategies. Experiments conducted on two public scene classification datasets demonstrate that MIA effectively reveals privacy leakage not captured by accuracy alone. Our results show that communication-efficient FL strategies reduce MIA success rates while maintaining competitive performance. These findings confirm MIA as a practical metric and highlight the importance of integrating privacy measurement into FL system design for remote sensing applications.

Problem

• Federated Learning
• Privacy Measurement
• Membership Inference Attacks
• Remote Sensing Images
• Privacy Leakage

Innovation

• Membership Inference Attack
• Federated Learning
• Privacy Measurement
• Remote Sensing Images
• Black-box Attack