Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks

Summary

The paper asks whether an honest-but-curious federated-learning server can tell which client produced each transmitted weight delta, using the UCI HAR benchmark as an explicitly acknowledged proxy for vehicular IMU streams. With N=10 clients under Dirichlet(α=0.3) non-IID partitioning, logistic-regression, random-forest, and MLP attackers reach ≈1.000 accuracy on held-out updates (rounds 9–20) without defenses, while clipping alone (C=1.0) already cuts attack accuracy to 0.127 at 0.944 FL accuracy. Sweeping Gaussian noise, the authors nominate σ∈[0.1,0.2] as practical: attack accuracy 0.148–0.164 against a 0.100 random floor, FL accuracy 0.896–0.930. Rényi accounting yields very loose formal budgets (ε≈296 at σ=0.1, δ=1e-5), which the authors concede makes the defense empirical rather than formal at those levels. Ensemble FL over groups of K∈{2,3,5} empirically matches a 1/K anonymity bound (0.50/0.33/0.20). Main limitations: only 10 clients, 20 rounds, and three seeds on a proxy dataset with no vehicular data; Table II's DP budgets are internally inconsistent (ε non-monotone in σ: 12.1 at σ=0.5 vs 31.4 at σ=1.0); and standard FedAvg requires the server to know each update's sender, leaving the threat model's premise underspecified. Code is stated to be on GitHub. A careful, honest empirical study whose vehicular framing outruns its UCI HAR evidence.