AugMixCloak: A Defense against Membership Inference Attacks via Image Transformation

TL;DR

AugMixCloak addresses privacy leakage from membership inference attacks in decentralized federated learning by performing a test-time image transformation. It first detects potentially memorized queries via perceptual hashing (pHash) and, if indicated, applies a targeted combination of data augmentation and PCA-based information fusion, controlled by an automatic intensity tuner using the fusion weight $\alpha$ and augmentation count $n$. Across five datasets and multiple DFL topologies, it reduces attack success (MIA F1 around 0.5) while preserving benign accuracy, outperforming L2 regularization and showing better generalization than confidence-score masking. The approach is lightweight, deployment-friendly, and compatible with existing defenses, offering practical privacy gains without modifying training or architecture. It also provides an automatic mechanism to balance privacy and utility via tunable parameters, facilitating adoption in real-world FL deployments.

Abstract

Traditional machine learning (ML) raises serious privacy concerns, while federated learning (FL) mitigates the risk of data leakage by keeping data on local devices. However, the training process of FL can still leak sensitive information, which adversaries may exploit to infer private data. One of the most prominent threats is the membership inference attack (MIA), where the adversary aims to determine whether a particular data record was part of the training set. This paper addresses this problem through a two-stage defense called AugMixCloak. The core idea is to apply data augmentation and principal component analysis (PCA)-based information fusion to query images, which are detected by perceptual hashing (pHash) as either identical to or highly similar to images in the training set. Experimental results show that AugMixCloak successfully defends against both binary classifier-based MIA and metric-based MIA across five datasets and various decentralized FL (DFL) topologies. Compared with regularization-based defenses, AugMixCloak demonstrates stronger protection. Compared with confidence score masking, AugMixCloak exhibits better generalization.

Figures (10)

• Figure 1: Methodology
• Figure 2: Duplicate Hashes in Training Set
• Figure 3: Test Hash Occurrence in Training Set
• Figure 4: Performing Fusion with a PCA-Reconstructed Image
• Figure 5: Accuracy vs Intensity